Analytic Tableaux Calculi for KLM Logics of 
Nonmonotonic Reasoning 



LAURA GIORDANO 

Dipartimento di Informatica - Universita del Piemonte Orientale A. Avogadro 
and 

VALENTINA GLIOZZI 
Universita degli Studi di Torino 
and 

NICOLA OLIVETTI 

LSIS - UMR CNRS 6168 Universite Paul Cezanne (Aix-Marseille 3) 
and 

GIAN LUCA POZZATO 
Universita degli Studi di Torino 



We present tableau calculi for some logics of nonmonotonic reasoning, as defined by Kraus, 
Lehmann and Magidor. We give a tableau proof procedure for all KLM logics, namely pref- 
erential, loop-cumulative, cumulative and rational logics. Our calculi are obtained by introducing 
suitable modalities to interpret conditional assertions. We provide a decision procedure for the 
logics considered, and we study their complexity. 

Categories and Subject Descriptors: F.4.1 [Mathematical Logic and Formal Languages]: 
Mathematical Logic — Computational Logic; Proof Theory; L2.3 [Artificial Intelligence]: De- 
duction and Theorem Proving — Deduction; Nonmonotonic reasoning and belief revision 

Additional Key Words and Phrases: Analytic Tableaux Calculi, Nonmonotonic Reasoning 



1. INTRODUCTION 

In the early 90s [Kraus et aL 1990] Kraus, Lehmann and Magidor (from now on 
KLIVI) proposed a formaUzation of nonmonotonic reasoning that was early rec- 
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ognized as a landmark. Their work stemmed from two sources: the theory of 
nonmonotonic consequence relations initiated by Gabbay [Gabbay 1985] and the 
preferential semantics proposed by Shoham [Shoham 1987] as a generalization of 
Circumscription. Their work led to a classification of nonmonotonic consequence 
relations, determining a hierarchy of stronger and stronger systems. The so called 
KLM properties have been widely accepted as the "conservative core" of default 
reasoning. The role of KLM logics is similar to the role of AGM postulates in Belief 
Revision [Gardenfors 1988]: they give a set of postulates for default reasoning that 
any concrete reasoning mechanism should satisfy. 

According to the KLM framework, defeasible knowledge is represented by a (fi- 
nite) set of nonmonotonic conditionals or assertions of the form 

whose reading is normally (or typically) the A's are B's. The operator "|~" is 
nonmonotonic, in the sense that A B does not imply A hC \^ B. For instance, 
a knowledge base K may contain the following set of conditionals: 

adult |~ worker, adult |~ taxpayer, student |~ adult, student |~ -^worker, 

student |~ -^taxpayer, retired |~ adult, retired h -^worker 

whose meaning is that adults typically work, adults typically pay taxes, students 
are typically adults, but they typically do not work, nor do they pay taxes, and so 
on. Observe that if |~ were interpreted as classical (or intuitionistic) implication, we 
simply would get student |~ _L, retired |~ _L, i.e. typically there are not students, 
nor retired people, thereby obtaining a trivial knowledge base. One can derive new 
conditional assertions from the knowledge base by means of a set of inference rules. 

In KLM framework, the set of adopted inference rules defines some fundamental 
types of inference systems, namely, from the weakest to the strongest: Cumulative 
(C), Loop-Cumulative (CL), Preferential (P) and Rational (R) logic. All these 
systems allow one to infer new assertions from a given knowledge base K without 
incurring in the trivializing conclusions of classical logic: regarding our example, in 
none of them, one can infer student |~ worker or retired |~ worker. In cumulative 
logics (both C and CL) one can infer adult /\ student |~ -iworker (giving preference 
to more specific information) , in Preferential logic P one can also infer that adult |~ 
-iretired (i.e. typical adults are not retired). In the rational case R, if one further 
knows that -'{adult |~ -imarried) (i.e. it is not the case that adults are typically 
unmarried), one can also infer that adult A married |~ worker. 

From a semantic point of view, to each logic (C, CL, P, R) corresponds one kind 
of models, namely possible-world structures equipped with a preference relation 
among worlds or states. More precisely, for P we have models with a preference 
relation (an irreflexive and transitive relation) on worlds. For the stronger R the 
preference relation is further assumed to be modular. For the weaker logic CL, the 
transitive and irreflexive preference relation is defined on states, where a state can be 
identified, intuitively, with a set of worlds. In the weakest case of C, the preference 
relation is on states, as for CL, but it is no longer assumed to be transitive. In all 
cases, the meaning of a conditional assertion A \^ B is that B holds in the most 
preferred worlds/states where A holds. 
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In KLM framework the operator 'V" is considered as a mcta-language operator, 
rather than as a connective in the object language. However, it has been readily 
observed that KLM systems P and R coincide to a large extent with the flat 
(i.e. unnested) fragments of well-known conditional logics, once we interpret the 
operator "|~" as a binary connective [Crocco and Lamarre 1992; Boutilier 1994; 
Katsuno and Sato 1991]. 

A recent result by Halpern and Friedman [Friedman and Halpern 2001] has shown 
that preferential and rational logic are natural and general systems: surprisingly 
enough, the axiom system of preferential (likewise of rational logic) is complete 
with respect to a wide spectrum of semantics, from ranked models, to parametrized 
probabilistic structures, e-semantics and possibilistic structures. The reason is that 
all these structures are examples of plausibility structures and the truth in them 
is captured by the axioms of preferential (or rational) logic. These results, and 
their extensions to the first order setting [Friedman et al. 2000] are the source 
of a renewed interest in KLM framework. A considerable amount of research in 
the area has then concentrated in developing concrete mechanisms for plausible 
reasoning in accordance with KLM systems (P and R mostly). These mechanisms 
are defined by exploiting a variety of models of reasoning under uncertainty (ranked 
models, belief functions, possibilistic logic, etc. [Benferhat et al. 1997; Benferhat 
et al. 2000; Weydert 2003; Pearl 1990; Makinson 2005; 2003]) that provide, as we 
remarked, alternative semantics to KLM systems. These mechanisms are based on 
the restriction of the semantics to preferred classes of models of KLM logics; this 
is also the case of Lehmann's notion of rational closure introduced in [Lehmann 
and Magidor 1992] (not to be confused with the logic R). More recent research has 
also explored the integration of KLM framework with paraconsistcnt logics [Arieli 
and Avron 2000]. Finally, there has been some recent investigation on the relation 
between KLM systems and decision-theory [Dubois et al. 2002; Dubois ct al. 2003]. 

Even if KLM was born as an inferential approach to nonmonotonic reasoning, 
curiously enough, there has not been much investigation on deductive mechanisms 
for these logics. In short, the state of the art is as follows: 

— Lehmann and Magidor [Lehmann and Magidor 1992] have proved that validity in 
P is coNP-complete. Their decision procedure for P is more a theoretical tool 
than a practical algorithm, as it requires to guess sets of indexes and prepositional 
evaluations. They have also provided another procedure for P that exploits its 
reduction to R. However, the reduction of P to R breaks down if boolean combi- 
nations of conditionals are allowed, indeed it is exactly when such combinations 
are allowed that the difference between P and R arises. 

— A tableau proof procedure for C has been given in [Artosi et al. 2002]. Their 
tableau procedure is fairly complicated; it uses labels and a complex unification 
mechanism. Moreover, the authors show how to extend the system to Loop- 
Cumulative logic CL and discuss some ways to extend it to the other logics. 

— In [Giordano et al. 2003] and [Giordano et al. 2005] some labelled tableaux calculi 
have been defined for the conditional logic CE and its main extensions, including 
CV. The flat fragment (i.e. without nested conditionals) of CE and of CV 
corresponds respectively to P and to R. These calculi however need a fairly 
complicated loop-checking mechanism to ensure termination. It is not clear if 
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they match complexity bounds and if they can be adapted in a simple way to 
CL and to C. 

— Finally, decidability of P and R has also been obtained by interpreting them into 
standard modal logics, as it is done by Boutilier [Boutilier 1994]. However, his 
mapping is not very direct and natural, as we discuss below. 

— To the best of our knowledge, for CL no decision procedure and complexity 
bound was known before the present work. 

In this work we introduce tableau procedures for all KLM logics, starting with 
the preferential logic P. Our approach is based on a novel interpretation of P into 
modal logics. As a difference with previous approaches (e.g. Crocco and Lamarre 
[Crocco and Lamarre 1992] and Boutillier [Boutilier 1994]), that take S4 as the 
modal counterpart of P, we consider here G6del-L6b modal logic of provability G 
(see for instance [Hughes and Cresswell 1984]). Our tableau method provides a sort 
of run-time translation of P into modal logic G. 

The idea is simply to interpret the preference relation as an accessibility relation: 
a conditional A \^ B holds in a model if B is true in all minimal A-worlds w (i.e. 
worlds in which A holds and that are minimal). An A- world w is a minimal A- 
world if all smaller worlds are not A-worlds. The relation with modal logic G is 
motivated by the fact that we assume, following KLM. the so-called smoothness 
condition, which is related to the well-known limit assumption. This condition 
ensures that minimal A-worlds exist whenever there are A-worlds, by preventing 
infinitely descending chains of worlds. This condition therefore corresponds to the 
finite-chain condition on the accessibility relation (as in modal logic G). Therefore, 
our interpretation of conditionals is different from the one proposed by Boutilier, 
who rejects the smoothness condition and then gives a less natural (and more 
complicated) interpretation of P into modal logic S4. 

As a further difference with previous approaches, we do not give a formal trans- 
lation of P into G. Rather, we directly provide a tableau calculus for P. One can 
notice some similarities between some of the rules for P and some of the rules 
for G. This is due to the correspondence between the semantics of the two logics. 
For deductive purposes, we believe that our approach is more direct, intuitive, and 
efficient than translating P into G and then using a calculus for G. 

We arc able to extend our approach to the cases of CL and C by using a second 
modality which takes care of states. Regarding CL, we show that we can map 
CL-models into P-models with an additional modality. The very fact that one 
can interpret CL into P by means of an additional modality does not seem to be 
previously known and might be of independent interest. In both cases, P and CL, 
we can define a decision procedure and obtain also a complexity bound for these 
logics, namely that they are both coNP-complete. In case of CL this bound is 
new, to the best of our knowledge. 

We treat C in a similar way: we can establish a mapping between Cumulative 
models and a kind of bi-modal models. However, because of the lack of transitivity, 
the target modal logic is no longer G. The reason is that the smoothness condition 
(for any formula A, if a state satisfies A, then either it is minimal or it admits a 
smaller minimal state satisfying A) can no longer be identified with the finite-chain 
condition of G. As a matter of fact, the smoothness condition for C cannot be 
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identified with any property of the accessibility relation, as it involves unavoidably 
the evaluation of formulas in worlds. We can still derive a tableau calculus based 
on our semantic mapping. But we pay a price: as a difference with P and CL the 
calculus for C requires a sort of (analytic) cut rule to account for the smoothness 
condition. This calculus gives nonetheless a decision procedure for C. 

Finally, we consider the case of the strongest logic R; as for the other weaker 
systems, our approach is based on an interpretation of R into an extension of 
modal logic G, including modularity of the preference relation (previous approaches 
[Crocco and Lamarre 1992; Boutilier 1994] take S4.3 as the modal counterpart of 
R). As a difference with the tableau calculi introduced for P, CL, and C, here we 
develop a labelled tableau system, which seems to be the most natural approach in 
order to capture the modularity of the preference relation. The calculus defines a 
systematic procedure which allows the satisfiability problem for R to be decided in 
nondeterministic polynomial time, in accordance with the known complexity results 
for this logic. 

All the calculi presented in this paper have been implemented in SICStus Prolog. 
To the best of our knowledge, our theorem prover, called KLMLean, is the first one 
for KLM logics^ 

The plan of the paper is as follows: in section 2, we recall KLM logics (from the 
strongest to the weakest): R, P, CL, and C, and we show how their semantics can 
be represented by standard Kripke models. In section 3 we give a tableau calculus 
for P. We then elaborate this calculus in order to obtain a terminating procedure. 
We propose a further refinement that gives a coNP decision procedure. The latter 
is based on a tighter semantics of P in terms of multi-linear models. In section 4 
we propose similar calculi for CL. In section 5, we give a tableau calculus for C. 
As mentioned above, the calculus requires a form of cut-rule. We prove however 
that we can restrict its application in an analytic way (namely, it is needed only 
for formulas A that are antecedents of conditionals A \^ B contained in the initial 
set of formulas). In section 6 we describe a labelled tableau calculus for R, then 
we refine it in order to obtain a terminating procedure and to describe a coNP 
decision procedure. 

2. KLM LOGICS 

We briefly recall the axiomatizations and semantics of the KLM systems. For 
the sake of exposition, we present the systems in the order from the strongest 
to the weakest: R, P, CL, and C. For a complete picture of KLM systems, see 
[Kraus et al. 1990; Lehmann and Magidor 1992]. The language of KLM logics 
consists just of conditional assertions A \^ B. We consider a richer language allowing 
boolean combinations of assertions and propositional formulas. Our language C is 
defined from a set of propositional variables ATM, the boolean connectives and 
the conditional operator |~. We use A,B,C,... to denote propositional formulas 
(that do not contain conditional formulas), whereas F,G,... are used to denote 
all formulas (including conditionals); F, A,... represent sets of formulas, whereas 



^The theorem prover KLMLean is not presented here. A description can be found in 
[Olivetti and Pozzato 2005] and in [Pozzato 2006]. KLMLean can be downloaded at 
http: / /www.di .unito . it/^pozzato/klmleajL2 . 0. 
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X, y, ... denote sets of sets of formulas. The formulas of L are defined as follows: 
if A is a propositional formula, A e if A and B arc propositional formulas, 
A |~ i? G £; if is a boolean combination of formulas of £, _F G L. 

2.1 Rational Logic R 

The axiomatization of R consists of all axioms and rules of propositional calculus 
together with the following axioms and rules. We use hpc to denote provability in 
the propositional calculus, whereas h is used to denote provability in R: 

— REF. Ay. A (reflexivity) 

— LLE. If hpc A ^ B, then h {A h C) {B h C) (left logical equivalence) 
— RW. If hpc A^B, then h (C h A) (C h B) (right weakening) 
—CM. {{A h B) A (A h C)) ^ (A A B h C") (cautious monotonicity) 
—AND. ((A h S) A (A h C)) ^ (A h B A C) 
—OR. ((A h C) A (B h C)) ^ (A V B h C) 

— RM. ((A |~ B) A ^(A |~ -.C)) {[A A C) |~ B) (rational monotonicity) 

REF states that A is always a default conclusion of A. LLE states that the syntactic 
form of the antecedent of a conditional formula is irrelevant. RW describes a similar 
property of the consequent. This allows to combine default and logical reasoning 
[Friedman and Halpern 2001]. CM states that if B and C are two default conclusions 
of A, then adding one of the two conclusions to A will not cause the retraction of the 
other conclusion. AND states that it is possible to combine two default conclusions. 
OR states that it is allowed to reason by cases: if C is the default conclusion of two 
premises A and B, then it is also the default conclusion of their disjunction. RM is 
the rule of rational monotonicity, which characterizes the logic R^: ii A \~ B and 
-^{A \~ -^C) hold, then one can infer A AC |~ B. This rule allows a conditional to be 
inferred from a set of conditionals in absence of other information. More precisely, 
"it says that an agent should not have to retract any previous defeasible conclusion 
when learning about a new fact the negation of which was not previously derivable" 
[Lehmann and Magidor 1992]. 

The semantics of R is defined by considering possible world structures with a 
preference relation (a strict partial order, i.e. an irreflexive and transitive relation) 
w < w' , whose meaning is that w is preferred to w' . The preference relation is 
also supposed to be modular: for all w, wi and W2, if wi < W2 then either wi < w 
OT w < W2- We have that A B holds in a model if i? holds in all minimal 
worlds (with respect to the relation <) where A holds. This definition makes sense 
provided minimal worlds for A exist whenever there are A- worlds. This is ensured 
by the smoothness condition in the next definition. 

Definition 2.1 Semantics of R, Definition 14 in [Lehmann and Magidor 1992]. 
A rational model is a triple 

M = {W,<,V) 

where: 

^As we will see in section 2.2, the axiom system of the weaker logic P can be obtained from the 
axioms of R without RM. 
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— W is a non-empty set of items called worlds; 

— < is an irreflexive, transitive and modular relation on W; 

— V is a function V : W i — > pow{ATM), which assigns to every world w the set 
of atoms holding in that world. 

We define the truth conditions for a formula F as follows: 

— If F is a boolean combination of formulas, A4, w \^ F is defined as for proposi- 
tional logic; 

— Let A be a propositional formula; we define A4in^{A) = {weW\J^,w\^A 

and \/w' , w' < w implies Ai,w' ^ A}; 
— M,w \= A\^ B if for all w' , if w' e Min^{A) then M,w' \= B. 

(Smoothness Condition). The relation < satisfies the following condition, called 
smoothness; if A4,w \= A, then w G Min^{A) or 3w' G Min^{A) such that 
w' < w. 

We say that a formula F is vaUd in a model A4, denoted with Ai \= F , if Ai,w \^ F 
for every w S W. A formula is vahd if it is valid in every model A4. A formula F 
is satisfiable if there exists a model M. such that A4 [=: F. 

Observe that the above definition of rational model extends the one given by KLM 
to boolean combinations of formulas. 

Notice also that the truth conditions for conditional formulas are given with 
respect to single possible worlds for uniformity sake. Since the truth value of a 
conditional only depends on global properties of A^, we have that: J^,w A \^ B 
iSM[=A^B. 

By the transitivity of <, the smoothness condition is equivalent to the following 
Strong Smoothness Condition, namely that for all A and w, if there is a world w' 
preferred to w that satisfies A (i.e. if 3w' : w' < w and A4,w' |= then there is 
also a minimal such world (i.e. 3w" : w" G Min^{A) and w" < w). This follows 
immediately: by the smoothness condition, since Ai,w' \^ A, either w' G Min^{A) 
(and the property immediately follows) or 3w" s.t. w" < w' and w" G Min^(A); in 
turn, by transitivity w" < w. Observe that this holds for all A, whether M.,w \= A 
or not. In turn, this entails that < does not have infinite descending chains. Ob- 
serve also that by the modularity of < it follows that possible worlds of W are 
clustered into equivalence classes, each class consisting of worlds that are incompa- 
rable to one another; the classes are totally ordered^. In other words the property 
of modularity determines a ranking of worlds so that the semantics of R can be 
specified equivalently in terms of ranked models [Lehmann and Magidor 1992]. By 
means of the modularity condition on the preference relation, we can also prove the 
following theorem, whose detailed proof can be found in the Appendix. We write 
A B G+ T (resp. A |~ _B G_ T) \i A B occurs positively (resp. negatively) in 
r, where positive and negative occurrences are defined in the standard way. 

Theorem 2.2 Small Model Theorem. For any F C £, ifV is satisfiable in 
a rational model, then it is satisfiable in a rational model containing at most n 
worlds, where n is the size ofT, i.e. the length of the string representing T. 

^Notice that the worlds themselves may be incomparable since the relation < is not assumed to 
be (weakly) connected. 
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Proof sketch. Let F be satisfiable in a rational model Ai = (W, <,V), i.e. M,xo 
r for some xq G W. Wc build the model M' = (W, <', V) as follows. 

— We build the set of worlds W" by means of the following procedure: 

(1) W ^ {xoh 

(2) for each A, h e_ T do 

— choose Xi £W s.t. Xi E A/m<(Ai) and A^,Xi ^ B^; 
— W' * — W U {x,}; 

(3) for each |~ €+ F do 

if Min^{Ai) ^ 0, and there is no x^ s.t. a;^ G A/i7i<(Ai) and 
Xi is already in W' then 
— choose any Xi G Min<(^i); 
— W' ^ — W U {x,}] 
— For all Xi, Xj G W, we let Xi <' Xj if Xi < Xj] 
—For all x^ G W, we let V'{x,) = l/(a;,). 

We can easily show that W' is a rational model satisfying F. 

■ 

In the calculus for R, that we will introduce in section 6, we need a slightly extended 
language Cr. Cr extends C by formulas of the form DA, where A is propositional, 
whose intuitive meaning is that DA holds in a world w if A holds in all the worlds 
preferred to w (i.e. in all w' such that w' < w). We extend the notion of rational 
model to provide an evaluation of boxed formulas as follows: 

Definition 2.3 Truth condition of modality □. We define the truth con- 
dition of a boxed formula as follows: 

Ai,w \= DA if, for every w' G W, if w' < w then A4,w' \= A 

From definition of Miji^{A) in Definition 2.1 above, and Definition 2.3, it follows 
that for any formula A, w € Min^{A) iS M,w ^ ^4 A D->A. 

Notice that by the Strong Smoothness Condition, it holds that ii M,w ^ D^A, 
then 3w' < w: A4,w' ^ A A D^A. If we regard the relation < as the inverse of 
the accessibility relation R (thus xRy if ?/ < cc), it immediately follows that the 
Strong Smoothness Condition is an instance of the property G (restricted to A 
propositional). Hence it turns out that the modality □ has the properties of modal 
system G, in which the accessibility relation is transitive and does not have infinite 
ascending chains. 

Since we have introduced boxed formulas for capturing a notion of minimality 
among worlds, in the rest of the paper we will only use this modality in front of 
negated formulas. Hence, to be precise, the language Cr of our tableau extends C 
with modal formulas of the form D-iA. 

2.2 Preferential Logic P 

The axiomatization of P can be obtained from the axiomatization of R by removing 
the axiom RM. As for R, the semantics of P is defined by considering possible 
world structures with a preference relation (an irreflexive and transitive relation), 
which is no longer assumed to be modular. 
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Definition 2.4 Semantics of P, Definition 16 in [Kraus et al. 1990]. A 
preferential model is a triple 

M = {W,<,V) 

where W and V are defined as for rational models in Definition 2.1, and < is an 
irreflexive and transitive relation on W. The truth conditions for a formula F, the 
smoothness condition, and the notions of validity of a formula are defined as for 
rational models in Definition 2.1. 

As for rational models, we have extended the definition of preferential models given 
by KLM in order to deal with boolean combinations of formulas. 

Even in this case, we define the satisfiability of conditional formulas with respect 
to worlds rather than with respect to models for uniformity sake. As for R, by the 
transitivity of <, the smoothness condition is equivalent to the Strong Smoothness 
Condition. In turn, this entails that < does not have infinite descending chains. 

Here again, wc consider the language Cp of the calculus introduced in section 
3; Cp corresponds to the language Cp, i.e. it extends C by boxed formulas of 
the form D-iA. It follows that, even in P, we can prove that, for any formula A, 
w e Min<_{A) iff A^, w ^ ^ A U^A. 

2.2.1 Multi-linear models for P. In the following of the paper we will need a 
special kind of preferential models, that wc call multi-linear. As we will see, these 
models will be useful in order to provide an optimal calculus for P. Indeed, as we 
will see in section 3.1, our calculus for P based on multi- linear models will allow us 
to define proof search procedures for testing the satisfiability of a set of formulas in 
P in nondeterministic polynomial time. This result matches the known complexity 
results for P, according to which the problem of validity for P is in coNP. 

Definition 2.5. A finite preferential model M = {W,<,V) is multi-linear if 
the set of worlds W can he partitioned into a set of components Wi for i — 1, . . . ,n, 
that is W = WiLI . . .UWn and 

{1) the relation < is a total order on each Wi/ 

(2) the elements in two different components Wi and Wj are incomparable with 
respect to <. 

The following theorem shows that wc could restrict our consideration to multi-linear 
models and generalizes Lemma 8 in [Lehmann and Magidor 1992]. The proof can 
be found in the Appendix. 

Theorem 2.6. Let T be any set of formulas, if T is satisfiahle then it has a 
multi-linear model. 

2.3 Loop Cumulative Logic CL 

The next KLM logic wc consider is CL, weaker than P. The axiomatization of CL 
can be obtained from the axiomatization of P by removing the axiom OR and by 
adding the following infinite set of LOOP axioms: 

LOOP. {Ao h ^i) A {Al h A2)...(A„_i h A„) A {A„ h ^o) ^ (^o h A,) 
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and the following axiom CUT: 

CUT. {{A [^B)A{AaB k C)) ^ {A h C) 

Notice that these axioms are derivable in P (and therefore in R). 

The following Definition is essentially the same as Definition 13 in [Kraus ct al. 
1990], but it is extended to boolean combinations of conditionals. 

Definition 2.7 Semantics of CL. A loop-cumulative model is a tuple 

M = {S,W,l,<,V) 

where: 

— S is a set, whose elements are called states; 
— W is a set of possible worlds; 

— / : S i—>- pow{W) is a function that labels every state with a nonempty set of 
worlds; 

— < is an irrefiexive and transitive relation on S ; 

— V is a valuation function V : W i — > pow{ATM), which assigns to every world 
w the atoms holding in that world. 

For s £ S and A propositional, we let M,s |= A if\/w G l{s), M,w |= A, where 
M.,w \= A is defined as for propositional logic. Let Min^{A) be the set of minimal 
states s such that M.,s |= A. We define M.,s |= A |~ B if 'is' G Mm<(A), 
M.,s' \= B. The relation \= can be extended to boolean combinations of conditionals 
in the standard way. We assume that < satisfies the smoothness condition. 

The above notion of cumulative model extends the one given by KLM to boolean 
combinations of conditionals. A further extension to arbitrary boolean combina- 
tions will be provided by the notion of CL-preferential model below. 

Here again, we define satisfiability of conditionals with respect to states rather 
than with respect to models for imiformity reasons. Indeed, a conditional is satisfied 
by a state of a model only if and only if it is satisfied by all the states of that model, 
hence by the whole model. 

As for P and R, by the transitivity of <, the smoothness condition is equivalent 
to the Strong Smoothness Condition. In turn, this entails that < does not have 
infinite descending chains. 

We show that we can map loop-cumulative models into preferential models ex- 
tended with an additional accessibility relation R. We call these preferential models 
CL-preferential models. The idea is to represent states as sets of possible worlds 
related by R in such a way that a formula is satisfied in a state s just in case 
it is satisfied in all possible worlds w' accessible from a world w corresponding 
to s. The syntactic counterpart of the extra accessibility relation i? is a modal- 
ity L. Given a loop-cumulative model A4 and the corresponding CL-preferential 
model Ai', M,s \= A iff for a world w S A^' corresponding to s, we have that 
M',w \= LA. As wc will sec, this mapping enables us to use a variant of the 
tableau calculus for P to deal with system CL. As for P, the tableau calculus for 
CL will use boxed formulas. In addition, it will also use i-formulas. Thus, the 
formulas that appear in the tableaux for CL belong to the language Cl obtained 
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from L as follows: (i) if A is prepositional, then A G £l; LA G ^-^LA £ Ll\ 
(ii) if A, B are propositional, then A \~ B E Cl\ {Hi) if is a boolean combination 
of formulas of £l, then F € Cl- Observe that the only allowed combination of □ 
and L is in formulas of the form O-iLA where A is propositional. 

We can map loop-cumulative models into preferential models with an additional 
accessibility relation as defined below: 

Definition 2.8 CL-preferential models. A CL-preferential model has the 
form 

M ^ (yy,i?,<,y) 

where: 

— W and V are defined as for preferential models in Definition 2.4; 
— < is an irrefiexive and transitive relation on W; 
— R is a serial accessibility relation; 

We add to the truth conditions for preferential models in Definition 2.4 the following 
clause: 

\= LA if, for all w' , wRw' implies A4,w' A 

The relation < satisfies the following Smoothness Condition.' ifA4,w \= LA, then 
w € Min^{LA) or 3w' G Min^{LA) such that w' <w. 

Moreover, we need to change the truth condition for conditional formulas as follows: 
M,w\^ A\^ B if for all w' G Min^{LA) we have M,w' ^ LB. 

We can prove that, given a loop-cumulative model — {S, W, I, <, V) satisfying a 
boolean combination of conditional formulas, one can build a CL-preferential model 
A4' = (W', R, <', V) satisfying the same combination of conditionals. We build a 
CL-preferential model M' = (W, R, <', V) as follows: 

— W = {(s,w) : seS and w G l{s)}; 
— (s, w)R{s, w') for aU (s, w), (s, w') G W"; 
— (s,w) <' (s',w') if s < s'; 
—V'{s,w) = V{w). 

Viceversa, given a CL-preferential model Ai = (W, R, <,V) satisfying a boolean 
combination of conditional formulas, one can build a loop-cumulative model M' — 
{S, W, I, <', V) satisfying the same combination of conditional formulas. The model 
A4' is defined as follows (we define Rw = {w' G W | (w, w') G R}): 

—S^{{w,Rw) \weW}; 

— l{{w, Rw)) = Rw; 

— (w, Rw) <' {w', Rw') if w < w'; 

—V'{w) = V{w). 

This is stated in a rigorous manner by the following proposition, whose proof can 
be found in the Appendix: 
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Proposition 2.9. A boolean combination of conditional formulas is satisfiable 
in a loop- cumulative model M. = {S, W, I, <,V) iff it is satisfiable in a CL-preferential 
model M' = {W\R,<',V'). 

Similarly to what done for P, we define multi-linear CL-preferential models as 
follows: 

Definition 2.10. A finite CL-preferential model M ~ {W, R, <,V) is multi- 
linear if the set of worlds W can be partitioned into a set of components Wi for 
i ^ 1,. . . ,n (that isW = WiU...U Wn), and in each Wi: 

{1) we can distinguish a chain of worlds Wi,W2, ■ ■ ■ ,Wh totally ordered w.r.t. < 
(i.e. wi < W2 < . ■ . < Wh) such that all other worlds w € Wi are R-accessible 
from some wi in the chain, i.e. G Wi such that w ^ wi,W2, . ■ . ,Wh, we 
have that wiRw V W2Rw V ... V WhRw; 

(2) for all wi,Wj,Wk, if wi < Wj and WjRwk, then wi < w^. 

Moreover, the elements of different Wi are incomparable w.r.t. <. 

We can easily prove the following Theorem: 

Theorem 2.11. Let T be any set of formulas, ifV is satisfiable in a CL-preferential 
model, then it has a multi-linear model. 

2.4 Cumulative Logic C 

The weakest logical system considered by KLM [Kraus et al. 1990] is Cumulative 
Logic C. System C is weaker than CL considered above since it does not have the 
set of (LOOP) axioms. At a semantic level, the difference between CL models and 
C models is that in CL models the relation < is transitive, whereas in C it is not. 
Thus, cumulative C models are defined as follows : 

Definition 2.12 Semantics of C, Definitions 5, 6, 7 in [Kraus et al. 1990]. 

A cumulative model is a tuple 

M = {S,W,l,<,V) 

where S, W, I, and V are defined as for loop- cumulative models in Definition 2.7, 
whereas < is an irrefiexive relation on S . The truth definitions of formulas are 
as for loop-cumulative models in Definition 2.7. We assume that < satisfies the 
smoothness condition. 

Since < is no longer transitive, the smoothness condition is no longer equivalent 
to the Strong Smoothness Condition; hence, in this case, we cannot show that < 
docs not have infinite descending chains. Indeed, the relation < might have cycles 
(leading to infinite descending chains) : it can be easily seen that in C we may have 
sequences of worlds such as: a minimal A-world followed by a minimal _B-world 
followed by a minimal ^-world and so on. This sequence respects the smoothness 
condition. However, one can legitimately wonder what minimal means in this case, 
the notion having lost its intuitive meaning. 

In order to be convinced that (1) the Strong Smoothness Condition and (2) the 
smoothness condition are not equivalent, consider the following set of formulas: 
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{-i(C |~ B), C\~A,A \~ B, B |~ C}. This set of formulas is unsatisfiablc in a model 
satisfying (1) whereas it is satisfiable in a model only satisfying (2), hence it is 
satisfiable in C. 

Similarly to what done for loop-eumulative models, we can establish a corre- 
spondence between cumulative models and preferential models augmented with an 
accessibility relation in which the preference relation < is an irreflexive relation 
satisfying the smoothness condition. We call these models C-preferential models. 

Definition 2.13 C-preferential models. A C-preferential model has the form 
Ai = (W, R, <,V) where: W is a non-empty set of items called worlds; R is a serial 
accessibility relation; < is an irreflexive relation on W satisfying the smoothness 
condition for L- formulas; V is a function V : W i — *■ pow{AT M) , which assigns to 
every world w the atomic formulas holding in that world. The truth conditions for 
the boolean cases are defined in the obvious way. Truth conditions for modal and 
conditional formulas are the same as in CL-preferential models in Definition 2.8, 
thus: 

— M,w 1= LA if for all w' , wRw' implies Ai,w' \= A 

—M,w ^ A h B if for all w' e Min^{LA), we have M,w' ^ LB. 

The correspondence between cumulative and preferential models is established by 
the following proposition. Its proof is the same as the proof of Proposition 2.9 
(except for transitivity) and is therefore omitted. 

Proposition 2.14. A boolean combination of conditional formulas is satisfiable 
in a cumulative model A4 ~ {S,yV,l, <,V) iff it is satisfiable in a C-preferential 
model M' = (W',i?, <',y)- 

In the following sections we present the tableaux calculi for the logics introduced. 
We start by presenting the calculus for P, which is the simpler and more general 
one. The calculi for CL, C, and R will become more understandable once the 
calculus for P is known. 

3. THE TABLEAU CALCULUS FOR PREFERENTIAL LOGIC P 

In this section we present a tableau calculus for P called TP, then we analyze 
it in order to obtain a decision procedure for this logic. We also give an explicit 
complexity bound for P. 

As already mentioned in section 2.2, we consider the language £p, which extends 
L by boxed formulas of the form D-iA. 

Definition 3.1 The calculus TP. The rules of the calculus manipulate sets 
of formulas F. We write T,F as a shorthand for F U {-F}. Moreover, given F we 
define the following sets: 




{n^A I n^A E F} 

= {^A I n^A e F} 

= {A\^ B \ A\r^ B eT} 

= {^{A h B) I -^{A h B) e F} 

= ri"^'^ u fI~" 



— F 
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The tableau rules are given in Figure 1. A tableau is a tree whose nodes are sets of 
formulas V . Therefore, a branch is a sequence of sets of formulas Fi, . . . , r„, . . . 
Each node Ti is obtained by its immediate predecessor F^-i by applying a rule of 
TP, having Ti-i as the premise and F,; as one of its conclusions. A branch is 
closed if one of its nodes is an instance o/(AX), otherwise it is open. We say that 
a tableau is closed if all its branches are closed. 



(AX) r, P, with P 6 ATM 



(-)■ 



r, ^^F 



r, F 



(A+). 



r, F A G 



T,F,G 



(v+). 



r, F V G 



r,F r, G 



(-+)■ 



r.F ^ G 



r,^F r,G 



(i~+) ■ 



T,^A,A K B 
r, -(A |~ B) 



A, □-.A, -.B,ri~='= 



T.A\~ B 



(A-) . 



(V- 



r, -,(F A G) 
T,^F r,^G 

T, ^(F V G) 



r, ^F, 



r, ^(F -» G) 



r,F, ^G 



r. -^□-.A, A |~ B r.B.A|~B 



r. ^n^A 



r°.r°\ri~±,A,n^A 



Fig. 1. Tableau system TP. 



The rues for the boolean propositions are the usual ones. According to the rule 
(^^~), if a negated conditional |~ B) holds in a world, then there is a minimal 
A-world (i.e. in which A and D-iA hold) which falsifies B. According to the rule 
if a positive conditional Ay^ B holds in a world, then either the world falsifies 
A or it is not minimal for A (i.e. -O^A holds) or it is a i?-world. According to 
the rule (□"), if a world satisfies -^U^A, by the strong smoothness condition there 
must be a preferred minimal A-world, i.e. a world in which A and \3^A hold. In 
our calculus TP, axioms are restricted to atomic formulas only. It is easy to extend 
axioms to a generic formula _F, as stated by the following Proposition: 

Proposition 3.2. Given a formula F and a set of formulas T, then F, _F, -iF 
has a closed tableau. 

Proof. By an easy inductive argument on the structure of the formula F . 
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-Ill, 




...,-ir,r 



a l~ tu,Bi,r K o,r ^w -iiih,->[J-ir, ii,D^fl,r 



(□-} 



X 



Fig. 2. A derivation of adult |~ worker, retired |~ adult, retired |~ ^worker, -^{adult |~ -^retired). 
For readability, we use a to denote adult, r for retired, and «) for worker. 

Definition 3.3. Given a set of formulas T, T is consistent if no tableau for T 
is closed. 

As an example, we show that adult |~ -iretired can be inferred from a knowledge 
base containing the following assertions: adult |~ worker, retired |~ adult, retired |~ 
^worker. Figure 2 shows a derivation for the initial set of formulas adult |~ 
worker, retired |~ adult, retired |~ -iworker, -'{adult |~ -iretired). 
Our tableau calculus TP is based on a runtime translation of conditional assertions 
into modal logic G. As we have seen in section 2.2, this allows a characterization 
of the minimal worlds satisfying a formula A (i.e., the worlds in Min^{A)) as the 
worlds w satisfying the formula AaO-iA. It is tempting to provide a full translation 
of the conditionals in the logic G, and then to use the standard tableau calculus 
for G. To this purpose, we can exploit the transitivity properties of G frames in 
order to capture the fact that conditionals are global to all worlds by the formula 
0{A A O^A — > B). Hence, the overall translation of a conditional formula A |~ B 
could be the following one: {A A D^A B) A D{A A D^A B). However, there 
are significant differences between the calculus resulting from the translation and 
our calculus. 

Using the standard tableau rules for G on the translation, we get the rule (h^) 
as a derived rule. Instead, the rule for dealing with negated conditionals (which 
would be translated in G as a disjunction of two formulas, namely {A A D-iA A 
-.B) V 0(A A U^A A -^B)), is rather different. 

Let us first observe that the rule (h~) we have introduced precisely captures 
the intuition that conditionals are global, hence (1) all conditionals are kept in the 
conclusion of the rule and (2) when moving to a new minimal world, all the boxed 
formulas (positive and negated) arc removed. Conversely, when the tableau rules 
for G are applied to the translation of the negated conditionals, we get two branches 
(due to the disjunction). None of the branches can be eliminated. In both branches 
all the boxed formulas are kept, while negated conditionals are erased. This is quite 
different from our rule (|~~), and it is not that obvious that the calculus obtained by 
the translation of P conditionals in G is equivalent to TP. Roughly speaking, point 
(2) can be explained as follows: when a negated conditional ^{A |~ B) is evaluated 
in a world w, this corresponds to finding a minimal A-world w' satisfying -iB (a 
world satisfying A,\I\^A,^B). w' does not depend from w (since conditionals are 
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global), hence boxed formulas, keeping information about w, can be removed. 

Also observe that, from the semantic point of view, the model extracted from an 
open tableau has the structure of a forest, while the model constructed by applying 
the tableau for G to the translation of conditionals has the structure of a tree. This 
difference is due to the fact that the above translation of P in G uses the same 
modality □ both for capturing the minimality condition and for modelling the fact 
that conditionals are global. For this reason, a translation to G as the one proposed 
above for P, would not be applicable to the cumulative logic C, as the relation < 
is not transitive in C. Moreover, the treatment of both the logics C and CL would 
anyhow require the addition to the language of a new modality to deal with states. 
The advantage of the runtime translation we have adopted is that of providing a 
uniform approach to deal with the different logics. 

The system TP is sound and complete with respect to the semantics. 

Theorem 3.4 Soundness of TP. The system TP is sound with respect to 
preferential models, i.e. if there is a closed tableau for a set T, then T is un- 
satisfiable. 

Proof. As usual, we proceed by induction on the structure of the closed tableau 
having the set F as a root. The base case is when the tableau consists of a single 
node; in this case, both P and -^P occur in F, therefore F is obviously unsatisfiable. 
For the inductive step, we have to show that, for each rule r, if all the conclusions of r 
are unsatisfiable, then the premise is unsatisfiable too. We show the contrapositive, 
i.e. we prove that if the premise of r is satisfiable, then at least one of the conclusions 
is satisfiable. Boolean cases are easy and left to the reader. We present the cases 
for conditional and box rules: 

— (|~^): if T,A\~B is satisfiable, then there exists a model Ai ~ (W, <, V) with 
some world w £ W such that A4,w \= T,A |~ B. We distinguish the two following 
cases: 

— A4,w ^ A, thus Ai,w \^ -^A: in this case, the left conclusion of the (h^) rule 

is satisfied {M,w ^ F, A |~ B, -^A); 
— A4,w \= A: we consider two subcases: 

— w G Min^{A): by the definition of Ai,w ^ A \~ B, we have that for all 
w' £ A/m<(A), M,w' \= B. Therefore, we have that M,w \= B and the 
right conclusion of (h''') is satisfiable; 
— w ^ Min^{A): by the smoothness condition, there exists a world w' < w 
such that w' G Min^{A); therefore, M,w \= -^D^A by the definition of □. 
The central conclusion of the (h"'") rule is then satisfiable. 
— (h"): if F,-.(A h B) is satisfiable, then M,w \= T and {*)M,w ^ A \^ B 
for some world w. By (*), there is a world w' in the model Ai such that w' G 
Min<{A) (i.e. {l)M,w' h ^ and (2)7W,w' h D^^) and {3)M,w' ^ B. By 
(1),(2) and (3), we have that M,w' \= A,a^A,^B'^. We conclude M,w' |= 
since conditionals are "global" in a model. 
— (n^): if F, -iQ-iA is satisfiable, then there is a model A4 and some world w 
such that M,w \= T,^D^A, then M,w ^ D->A. By the truth definition of 

"We use M,w' \= Fi,F2, . . . , F„ to denote that M,w' \= Fi, M,w' ^ F2, . . . , and M,w' \= Fn. 
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□ , there exists a world w' such that w' < w and Ai,w' |= A. By the Strong 
Smoothness Condition, we can assume that w' is a minimal A-world. Therefore, 
A4,w' ^ D-iA by the truth definition of □. It is easy to conclude that Ai, w' |= 
A, D-iA, rl~±^ r'-''^ , r'-', since 1. conditionals are global in a model, then M,w' \= 
rl'^^, 2. formulas in are true in w' since w' < w and 3. the < relation is 
transitive, thus boxed formulas holding in w (i.e. r°) also hold m w . 

■ 

To prove the completeness of TP wc have to show that if F is unsatisfiable, then 
there is a closed tableau starting with F. We prove the contrapositive, that is: if 
there is no closed tableau for F, then there is a model satisfying F. This proof is 
inspired by [Gore 1999]. First of all, we distinguish between static and dynamic 
rules. The rules (h~) and (□") are called dynamic, since their conclusion represents 
another world with respect to the premise; the other rules are called static, since 
the world represented by premise and conclusion(s) is the same. Moreover, we have 
to introduce the saturation of a set of formulas T . Given a set of formulas F, we 
say that it is saturated if all the rules have been applied. 

Definition 3.5 Saturated sets. A set of formulas F is saturated with respect 
to the static rules if the following conditions hold: 

—ifF AG eT then F eV andG e F; 
—if -^{F AG) eT then -^F eT or^Ge T; 
—ifFVGeT then F eT or G eT; 
—if ^{F V G) e F then ^F eT and ^G e T; 
—ifF^GeT then ^F eT or G e T; 
—if ^{F ^ G) G F then F e T and ^G e T; 
—if^^F e T then F e T; 

—if A\r^ B eT then -nAeT or -nO^A eT or B eT. 

It is easy to observe that the following Lemma holds (the proof can be found in the 
Appendix) : 

Lemma 3.6. Given a consistent finite set of formulas T, there is a consistent, 
finite, and saturated set F' 3 F. 

By Lemma 3.6, we can think of having a function which, given a consistent set F, 
returns one fixed consistent saturated set, denoted by SAT(F). Moreover, we denote 
by APPLY(F, F) the result of applying to F the rule for the principal connective in 
F. In case the rule for F has several conclusions (the case of a branching), we 
suppose that the function APPLY chooses one consistent conclusion in an arbitrary 
but fixed manner. 

Theorem 3.7 Completeness of TP. TF is complete w.r.t. preferential mod- 
els, i.e. if a set of formulas T is unsatisfiable, then it has a closed tableau in TP. 

Proof. Wc assume that no tableau for Fq is closed, then we construct a model for 
Fq. We build X, the set of worlds of the model, as follows: 

1. initialize X = {SAT(r())}; mark SAT(r()) as unresolved; 
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Fig. 3. 

while X contains unresolved nodes do 

2. ciioose an unresolved F from X; 

3. for each formula |~ B) £ F 

3a. let F^(AKS) =SAT(APPLY(F, ^(yl y-. B)))\ 
3b. ifF^(Ai^B) ^XthenX = Xu{F^(.4|^B,}; 

4. for each formula -^U^A G F, let V^u^a =SAT(APPLY(r, ^□-.A)); 
4a. add the relation T^^^a < F; 

4b. if F^n^A ^ X then X = X U {F^q^a}- 

5. mark F as resolved; 
endWhile; 

This procedure terminates, since the number of possible sets of formulas that can 
be obtained by applying TP's rules to an initial finite set F is finite. We construct 
the model M = {X, <x,V) for F as follows: 

• <x is the transitive closure of the relation <; 

• v(r) = {P I p e F n ATM} 

In order to show that is a preferential model for F, we prove the following facts: 

Fact 3.8. The relation <x is acyclic. 

Proof of Fact 3.8. If there were a loop, there would be Fi and F3 in X, s.t. 
Ts <x Ti, and Fi is obtained again from F3 by applying step 4 (i.e. Fi <x F3). 
However, this situation, presented in Figure 3, will never happen. Indeed, since 
Ts <x Ti; F3 has been generated by a sequence of applications of (□"), starting 
from an initial application of (□") to some formula -^D^A in Fi. By the (D^) rule, 
D^A G F3. If Fi were to be generated again from F3 by an application of (□"), 
then D^A € Fi, which contradicts the fact that Fi is consistent. We can reason in 
the same way for loops of any length. 

□ Fact 3.8 

Fact 3.9. The relation <x is irreflexive, transitive, and satisfies the smoothness 
condition. 
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Proof of Fact 3.9. Transitivity follows by construction. Irreflcxivity follows the 
acyclicity. As there are finitely many worlds, and the relation <x is acyclic, it 
follows that there cannot be infinitely descending chains. This fact, together with 
the transitivity of <x, entails that <x satisfies the smoothness condition. 

□ Fact 3.9 

The only rules introducing a new world in X in the procedure above are (h~) 
and (n^). Since these two rules keep positive conditionals in their conclusions, it 
follows that any positive conditional B belonging to SAT (To), where To is the 
initial set of formulas, also belongs to each world introduced in X. Furthermore, 
it can be easily shown that only the conditionals in SATCTq) belong to possible 
worlds in X . Indeed, all worlds in X are generated by the application of a dynamic 
rule, followed by the application of static rules for saturation. It can be shown that 
this combination of rules docs never introduce a new conditional. This gives the 
following Fact: 

Fact 3.10. Given a world A S X and any positive conditional B, we have 
that A\^BeAiffA\^Be SAKTo) . 

We conclude by proving the following Fact: 

Fact 3.11. For all formulas F and for all sets T ^ X we have that: 
(i) ifFeV then M,T ^ F; (ii) if^FGT then M,T^ F. 

Proof of Fact 3.11. By induction on the structure of F. If F is an atom P, then 
Per implies A^, T ^ P by definition of V. Moreover, -iP G T implies that P 
as r is consistent; thus, Ai,T ^ P (by definition of V). For the inductive step we 
only consider the case of (-i) |~ and (">)□: 

—□-.A e r. Then, for aU T, <x F we have -^A £ F, by definition of (□"), 
since F^ has been generated by a sequence of applications of (D^). By inductive 
hypothesis M,Ti ^ A for all F,; <x F, whence 7W, F |= O^A. 

— -iD-iA G F. By construction there is a F' s.t. F' <x F and A e F'. By inductive 
hypothesis M,T' \= A. Thus, M,T ^ D^A. 

—A \~ B eT. Let A e Min<^{A); one can observe that (1)^^ G A or {2)^O^A £ 
A or {3)B e A, since A ^ B G A hy Fact 3.10, and since A is saturated. (1) 
cannot be the case, since otherwise by inductive hypothesis M,A ^ A, which 
contradicts the definition of Min^^ (A). If (2). by construction of M there exists 
a set A' <x A such that A £ A'. By inductive hypothesis A4,A' \= A, which 
contradicts A G AIin^^{A). Thus it must be that {3)B S A, and by inductive 
hypothesis A4, A B. Hence, we can conclude A4,r ^ A \~ B. 

— ^{A h B) e F: by construction of X, there exists T' £ X such that A, D^A, ^B e 
F'. By inductive hypothesis we have that M,T' \= A and M,T' |= D^A. It 
follows that F' G Min^^{A). Furthermore, always by induction, M,T' ^ B. 
Hence, M,r^ A^ B. 

□ Fact 3.11 
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By the above Facts the proof of the completeness of TP is over, since is a model 
for the initial set Tq. 

m 

By Theorem 3.4 above and by the construction of the model done in the proof of 
Theorem 3.7 just above, we can show the following Corollary. 

Corollary 3.12 Finite model property. P has the finite model property. 

Proof. By Theorem 3.4, if F is satisfiable, then there is no closed tableau for F. By 
the construction in the proof of Theorem 3.7, if there is no closed tableau for F, 
then F is satisfiable in a finite model. 

■ 

A relevant property of the calculus that will be useful to estimate the complexity 
of logic P is the so-called disjunction property of conditional formulas: 

Proposition 3.13 Disjunction property. If there is a closed tableau for T,^{A |~ 
B), ^(C h D), then there is a closed tableau either for F, -i{A |~ B) or for F, -i(C |~ 
D). 

Proof. Consider a closed tableau for T,^{A |~ B),^{C |~ D). If the tableau does 
not contain any application of (h^), then the property immediately follows. The 
same holds if either ^{A |~ B) or -i(C |~ D) are not used in the tableau. Consider 
the case in which there is an application of (|~~) first to ^(C |~ D), and then to 
-^{A |~ B). We show that in this case there is also a closed tableau for F, -^{A |~ B). 
We can build a tableau of the form: 

r,^{A h B),^{C h D) 
Hi 

T',^iA^B),^iC ^D) _^ 

F'I~*,^(A \^ B),C,a^C,^D 
Ha 

r"^{A^B) 

T"^^ ,A,n^A,^B 

Since C and D are propositional formulas, C, D^C, and, eventually, their sub- 
formulas introduced by the application of some boolean rules in 112 , will be removed 
by the application of (h^) on ^{A |~ B). Therefore, one can obtain a closed tableau 
of F, h B) as follows: 

ni 

T\^{Ay.B) 

— 

V"^ ,A,U^A,^B 

Il'i is obtained by removing -i(C |~ D) from all the nodes of ni;n2 is obtained 
by removing from 112 the application of rules on C, -^D and their subformulas. 
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The symmetric case, corresponding to the case in which is appUed first on 

-^{A |~ B) and then on ^(C |~ D), can be proved in the same manner, thus we can 
conclude that F, -i(C h D) has a closed tableau. 



The reason why this property holds is that the (|~ ) rule discards all the other 
formulas that could have been introduced by its previous application. 

3.1 Decidability and Complexity of P 

3.1.1 Terminating procedure for P. In general, non-termination in tableau cal- 
culi can be caused by two different reasons: 1. some rules copy their principal 
formula in the conclusion, and can thus be reapplied over the same formula with- 
out any control; 2. dynamic rules may generate infinitely-many worlds, creating 
infinite branches. 

Concerning the second source of non-termination (point 2.), notice that infinitely- 
many worlds cannot be generated on a branch by (|~~) rule, since this rule can be 
applied only once to a given negated conditional on a branch. Another possible 
source of infinite branches could be determined by the interplay between rules 
{\^~^) and (n^). We show that this cannot occur, once we introduce the following 
standard restriction on the order of application of the rules. 

Definition 3.14 Restriction on the calculus. Building a tableau for a set 
of formulas T, the application of the (D^) rule must be postponed to the application 
of the propositional rules and to the verification that T is an instance of (AX) . 

It is easy to observe that, without the restriction above, point 2. could occur; 
for instance, consider the following trivial example, showing a branch of a tableau 
starting with P |~ Q, with P,Q € ATM: 



nn-,p, P h 



P, D-P, P h Q 

p, D^p, ^D^p, p h g 



(□-) 
■■■(□-) 



(*)-p,p,n-p,PhO 
i~+) 

nP, P, a^P, -nO^P, P [^Q 

(□-) 



.p,p,n^p,Ph 



nP, p, D^p, ^D^p, p h g 



In the above example, the (D^) rule is applied systematically before the other rules, 
thus generating an infinite branch. However, if the restriction in Definition 3.14 is 
adopted, as it is easy to observe, the procedure terminates at the step marked as 
(*). Indeed, the test that -iP, P, D-iP, P |~ Q is an instance of the axiom (AX) 
succeeds before applying (D^) again, and the branch is considered to be closed. 
As already mentioned, with the above restriction at hand, we can show (Lemma 3.20 
and Theorem 3.21) that the interplay between (h"*") and (□") does not generate 
branches containing infinitely-many worlds. Intuitively, the application of (D^) to 
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r, ^A:S.A |~ B 



r,A l~ B-.T. 



r,^n^A;S, A i~ B 



r,B:S.A |~ B 



r. -,n-,A- s 



(□-). 



],r°,r°\ri~±,yi,n^A;0 



Fig. 4. The calculus TP'^. Propositional rules are as in Figure 1 adding S. 



a formula -iQ-iA (introduced by (|~^)) adds the formula D-iA to the conclusfon, so 
that (h"*") can no longer consistently introduce —D^A. This is due to the properties 
of □ in G, and would not hold if □ had weaker properties (e.g. K4 properties). 

Concerning point 1. the above calculus TP docs not ensure a terminating proof 
search due to (h'*'), which can be applied without any control. We ensure the 
termination by putting some constraints on TP. The intuition is as follows: one 
does not need to apply (h^) on the same conditional formula A \^ B more than 
once in the same world, therefore we keep track of positive conditionals already used 
by moving them in an additional set S in the conclusions of (|~^), and restrict the 
application of this rule to unused conditionals only. The dynamic rules re-introduce 
formulas from E in order to allow further applications of {\^'^) in the other worlds. 
This machinery is standard. 

Theorem 3.21 below shows that no additional machinery is needed to ensure 
termination. Notice that this would not work in other systems (for instance, in 
K4 one needs a more sophisticated loop-checking as described in [Hcuerding et al. 
1996]). 

The terminating calculus TP"^ is presented in Figure 4. Observe that the tableau 
nodes are now pairs F; E. The calculus TP'^ is sound and complete with respect 
to the semantics: 

Theorem 3.15 Soundness and completeness of TP'^. Given a set of for- 
mulas T , it is unsatisfiable iff it has a closed tableau in TP"^. 

Proof. The soundness is immediate and left to the reader. The completeness easily 
follows from the fact that two applications of (h"*") to the same conditional in the 
same world are useless. Indeed, given a proof in TP, if (h"*") is applied twice to 
F, j4 l~ i? in the same world, then we can assume, without loss of generality, that 
the two applications are consecutive. Therefore, the second application of (h+) 
is useless, since each of the conclusions has already been obtained after the first 
application, and can be removed. 

■ 

Let us introduce a property of the tableau which will be crucial in many of the 
following proofs. Let us first define the notion of regular node. 

Definition 3.16. A node F;S is called regular if the following condition holds: 

if -^n^A e T, then there is A h S e F U E 

ACM Transactions on Computational Logic, Vol. V, No. N, February 20YY. 



Analytic Tableaux Calculi for KLM Logics of Nonmonotonic Reasoning • 23 



It is easy to see that all nodes in a tableau starting from a pair Fq; are regular, 
when To is a set of formulas of £. This is stated by the following Proposition, whose 
proof can be found in the Appendix: 

Proposition 3.17. Given a pair Vf)]%, where Fq is a set of formulas of C, all 
the tableaux obtained by applying TP"^ 's rules only contain regular nodes. 

From now on, we can assume without loss of generality that only regular nodes 
may occur in a tableau. 

In order to prove that TP"^ ensures a terminating proof search, wc define a complex- 
ity measure on a set of formulas F and the corresponding set of positive conditionals 
already used S, denoted by m(F; E), which consists of four measures ci, C2, C3 and 
C4 in a lexicographic order. We denote by cp{F) the complexity of a formula i^, 
defined as follows: 

Definition 3.18 Complexity of a formula. 

—cp{P) = 1, where P G ATM 
—cp{^F) = 1 + cp{F) 

— cp{F ^G) = 1 + cp{F) + cp{G), where is any binary boolean operator 

—cp[U^A) = 1 + cp{-^A) 

—cp{A h S) = 3 + cp{A) + cp{B). 

Definition 3.19. We define m(F;i;) = (ci, C2, C3, C4) where: 

— ci =1 {A h B G-V}\ 

— C2 =1 {A h B e+ F U S I U^A ^ F} | 

-C3=| {Ay^BG+ T] 

— C4 = EFercp(^) 

We consider the lexicographic order given by Tn{T] E), that is to say: given m(F; S) = 
(ci, C2, C3, C4) and m(F';S') = (c'j^, C2, Cg, C4), we say that m(F; E) < to(F';E') iff 
there exists i, i = 1,2,3,4, such that the following conditions hold: 

—Ci < c[ 

— for all j , < j < i, we have that Cj = c'^ 

Intuitively, ci is the number of negated conditionals to which the (|~^) rule can still 
be applied. An application of (|~~) reduces ci. C2 represents the number of positive 
conditionals which can still create a new world. The application of (□") reduces 
C2'. indeed, if (|~^) is applied to A |~ B, this application introduces a branch 
containing -iQ-iA; when a new world is generated by an application of (□") on 
-iQ-iA, it contains A and D-iA. If (|~+) is applied to A \~ B once again, then the 
conclusion where -iQ-iA is introduced leads to a closed branch, by the presence of 
O-iA in that branch. C3 is the number of positive conditionals not yet considered in 
that branch. C4 is the sum of the complexities of the formulas in F; an application 
of a boolean rule reduces C4. 

To prove that TP"^ ensures a terminating proof search, wc show that the tableau 
cannot contain an open branch of infinite length. To this purpose we need the 
following Lemma: 
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Lemma 3.20. Let F'; S' be obtained by an application of a rule o/ TP'^ to a 
premise T; S. Then, we have that either m{T'; E') < m{T; S) or TP'^ leads to the 
construction of a closed tableau for F'; E'. 

Proof. We consider each rule of the calcuhis TP^: 

— one can easily observe that the conditional formula -^{A |~ B) to which 
this rule is applied does not belong to the only conclusion. Hence the measure 
ci in 7Ti(F'; E'), say cy , is smaller than ci in m(F, A), say ci; 

— (D^): no negated conditional is added nor deleted in the conclusions, thus ci = 
c'l- Suppose we are considering an application of (D^) on a formula -^D^A. We 
can observe the following facts: 

— the formula -iQ-iA has been introduced by an application of (|~+), being this 
one the only rule introducing a boxed formula in the conclusion; more precisely, 
it derives from an application of (h"*") on a conditional formula A |~ B; 

— A |~ B belongs to both F; S and F'; S', since no rule of TP^ removes positive 
conditionals (at most, the (|~^) rule moves conditionals from F to E); 

— A \^ B does not "contribute" to C2', since the application of (□") introduces 
n^A in the conclusion F' (remember that C2' =| {A |~ B e+ F' U S' | D^A ^ 

r'} I). 

We distinguish two cases: 

(1) Q-iA does not belong to the premise of (□"): in this case, by the above 
facts, we can easily conclude that C2' < C2, since O^A belongs only to the 
conclusion; 

(2) D^A belongs to the premise of (□"): we are considering a derivation of the 
following type: 

r,a^A,^n^A 
Y\~±^r°,r°\^A,A,a^A ^ 

In this case, C2' = C2; however, we can conclude that the tableau built for 
Fl~±,F°,F°\^A,^,n^A is closed, since: 
— A is a prepositional formula 

— the restriction in Definition 3.14 leads to a proof in which the prepositional 
rules and (AX) are applied to A and -^A before (D^) is further applied. 
The resulting tableau is closed; 

— (|~^): we have that ci = c'l, since we have the same negated conditionals in the 
premise as in all the conclusions. The same for C2, since the formula A \~ B to 
which the rule is applied is also maintained in the conclusions (it moves from 
unused to already used conditionals). We conclude that m(F'; E') < to(F;E), 
since C31 < C3. Indeed, the (h+) rule moves A \~ B from F to the set E of already 
considered conditionals; 

— rules for the boolean connectives: it is easy to observe that ci, C2 and C3 are the 
same in the premise and in any conclusion, since conditional formulas are side 
formulas in the application of these rules. We conclude that m(F'; E') < m(F; E) 
since C41 < C4. Indeed, the complexity of the formula to which the rule is applied 
is greater than (the sum of) the complexity of its subformula(s) introduced in 
the conclusion(s). 
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Now we have all the elements to prove that TP'^ ensures termination in a proof 
search: 

Theorem 3.21 Termination of TP"^. TP"^ ensures a terminating proof search. 

Proof. By Lemma 3.20 we know that, starting from ro;0, the value of m(r; S) 
decreases each time a tableau rule is applied or leads to a closed tableau. Therefore, 
a finite number of applications of the rules leads either to build a closed tableau or 
to nodes F; E such that m(T; E) is minimal. In particular, we observe that, when 
the branch does not close, m(r; S) = (0, 0, 0, c^^^^), and the following facts hold: 

— no negated conditional belongs to T, since ci ^ 0; 
— for each A \^ B G T U T,, we have that 0-1^4 G F, since C2 = 0; 
— all positive conditionals A ^ B have been moved in E since C3 = 0; 
— F is saturated with respect to the propositional rules, since C4 assumes its minimal 
value C4,,jj^,^ . 

By the above facts it is easy to see that, in this case, either F; E is closed or 
no rule, with the exception of (D^), is applicable to F; E. Indeed, (|~~) rule is 
not applicable, since no negated conditional belongs to F. If (□") is applicable, 
then there is -iQ-iA G F, to which the rule is applied. However, since C2 = 0, 
we have also that D^A G F. Therefore, the conclusion of an application of (D^) 
contains both A and -^A and, by the restriction in Definition 3.14 and since A 
is propositional, the procedure terminates building a closed tableau, (h^) is not 
applicable, since no positive conditionals belong to F (all positive conditionals A |~ 
B have been moved in E). Last, no rule for the boolean connectives is applicable. 
For a contradiction, suppose one boolean rule is still applicable: by Lemma 3.20, 
the sum of the complexity of the formulas in the conclusion(s) decreases, i.e. C4 in 
the conclusion(s) is smaller than in the premise F; E, against the minimality of this 
measure in F; E. 

■ 

3.1.2 Optimal Proof Search Procedure for P. We conclude this section with a 
complexity analysis of TP'^ , in order to prove that validity in P is coNP-complete. 
Intuitively, we can obtain a coNP decision procedure, by taking advantage of the 
following facts: 

(1) Negated conditionals do not interact with the current world, nor they interact 
among themselves (by the disjunction property). Thus they can be handled 
separately and eliminated always as a first step. 

(2) We can replace the (□") which is responsible of backtracking in the tableau 
construction by a stronger rule that does not need backtracking. 

Regarding (1), by the disjunction property we can reformulate the (|~~) rule as 
follows: 

F,^(^hi3);E _ 
E,A,n^A,-.S,Fl'"^;0 
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This rule reduces the length of a branch at the price of making the proof search 
more non-deterministic. 

Regarding (2), we can adopt the following strengthened version of (□"). We use 
rE7 to denote {^D^Aj V Aj \ -^O^Aj Aj ^i}: 

E,ri-±,r°,r°\Ai,n-Ai,rEi ;0 I ... I i],ri-±,r°,r°\^„,n-A„,rE;;0 

The advantage of this rule over the original (D^) rule is that no backtracking on 
the choice of the formula -^D^Ai is needed. The reason is that all alternatives are 
kept in the conclusion. As we will see below, by using this rule we can provide a 
tableau construction algorithm with no backtracking. 

We call LTP^ the calculus obtained by replacing in TP"^ the initial rules (h^) 
and (□") with the ones reformulated above. We can prove that LTP'^ is sound 
and complete w.r.t. the preferential models. To prove soundness, we consider the 
multi- linear models introduced in section 2.2.1. 

Theorem 3.22. The rule (D^) is sound. 

Proof. Let F = F', -iQ-iAi, -^O^A2, . . . , -^D^An. We omit S for readability reasons. 
We prove that if F is satisfiable then also one conclusion of the rule 

Fl^=^,F°,F°''',yl„n^A<,F°" 

is satisfiable. By Theorem 2.6, we can assume that F is satisfiable in a multi-linear 
model M = (W, <,V), let Ai,x \= F. Then there are zi < x, . . . , Zn < x, such 
that Zi e Min^{Ai); thus A4,Zi ^ Ai A D-iA;; we easily have also that A4, Zi \= 
ph± pD pD'^ Being A4 a multi-linear model, the Zi, i = l,2,...,n, whenever 
distinct, are totally ordered: we have that Zi < x, so that they must belong to the 
same component. Let Zk be the maximum of z,, for a certain 1 < fc < n. We have 
that for each Zi {i ^ k) either (i) Zi = 2^ , so that M, Zk \= Ai , or (ii) Zi < Zk , so 
that A4, Zk \= -iQ-iAi. We have shown that for each i ^ Zk |= A^ V -iD-iA^. 

We can conclude that M,z^ FE^ • Thus 

A^,zfc hri~±,r°,F°\Afc,n-Afc,FE,: 

which is one of the conclusions of the rule. 

■ 

We can prove that the calculus obtained by replacing the (D^) rule with its stronger 
version (D^) is complete w.r.t. the semantics: 

Theorem 3.23. The calculus LTP'^ is complete. 

Proof. We repeat the same construction as in the proof of Theorem 3.7, in order to 
build a preferential model, more precisely a multi-linear model, of a set of formulas 
Fq for which there is no closed tableau. We denote by APPLY(F, RuleName) the 
result of applying the rule corresponding to RuleName to F. As a difference with 
the construction in Theorem 3.7, we replace point 4. by the points ^strong, '^astrong, 
'^b strong, and 4cstr-ong, obtaining the following procedure {X is the set of worlds of 
the model): 
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1. initialize X = {SAT(ro)}; mark SAT(ro) as unresolved; 
while X contains unresolved nodes do 

2. choose an unresolved V from X\ 

3. for each formula |~ B) £ F 

3a. let r^(Ai^fl) =SAT(APPLY(r, ^(A h B))); 

3b. if ^^(A^^s) ^ X then X = X \J {r^(^|^B)}; 
'^strong- if there is —D-^A £ T then 

4astrou9. let r' =SAT(APPLY(r,n7)); 

'^bstrong- add the relation F' < F; 

Acstrong. If F' ^ X then X^X\J{V'}- 
5. mark F as resolved; 
endWhile; 

Facts 3.8 and 3.9 can be proved as in Theorem 3.7. This holds also for Fact 3.11 
with one difference, for what concerns the case in which -D^A € F. In this case, 
by construction there is a F' such that F' <x F. We can prove by induction on the 
length n of the chain <x starting from F that if -^D^A e F, then M,T ^ D->A. 
If n = 1, it must be the case that A € T'; hence, by inductive hypothesis on the 
structure of the formula, M,r |= A, thus M,T ^ D^A. If n > 1, by the (Dj) 
rule, either A gT' and wc conclude as in the previous case, or -iQ-iA G F' and the 
Fact holds by inductive hypothesis on the length. 

■ 

We give a non-deterministic algorithm for testing satisfiability in P that: (i) takes 
a set of formulas F as input; (m) returns SAT iff F is satisfiable. By using the new 
version of (h~) rule, we can consider a negated conditional at a time. Indeed, for 
F, |~ B), -i(C |~ D) to be satisfiable, it is sufficient that both F, |~ B) and 
F, -i(C |~ D), separately considered, are satisfiable. For each negated conditional, 
the algorithm GENERAL-CHECK applies the rule (|~~) to it, and calls the algorithm 
CHECK on the resulting set of formulas. CHECK is a non-deterministic algorithm that 
tests satisfiability in P of a set of formulas not containing negated conditionals. 

Let EXPAND(F) be a procedure that returns one saturated expansion of F w.r.t. 
all static rules. In case of a branching rule, EXPAND nondeterministically selects 
(guesses) one conclusion of the rule. The algorithm below allows the satisfiability 
of a set of formulas (not containing negated conditionals) to be decided. In brackets 
we give the complexity of each operation, considering that ?i = | F |. 



CHECK(r) 

1. r < EXPAND(F); (0(n)) 

2. if F contains an axiom then return UNSAT; (0(n^)) 

3. if {^n^A I -nO^A G F} = then return SAT; 

4. else return CHECK (APPLY (F, )) ; 



Notice that the execution of APPLY (F,^^) chooses the branch generated by the 
application of {0~) to F. 

To see that CHECK is a nondetcrministic polynomial procedure to decide the sat- 
isfiability of a set of formulas (not containing negated conditionals), observe that: 
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(1) the complexity of each caU to the procedure EXPAND is polynomial. Indeed, as 
the number of different subformulas is at most 0(n), EXPAND makes at most 0{n) 
applications of the static rules. (2) The test that a set F (of size 0{n)) of formulas 
contains an axiom has at most complexity O(n^). (3) The number of recursive calls 
to the procedure CHECK is at most 0(n), since in a branch the rule (D^) can be 
applied only once for each formula -iQ-iAi, and the number of different negated 
box formulas is at most 0{n). 

Let us now define a procedure to decide whether an arbitrary set of formulas F 
(possibly containing negated conditionals) is satisfiable: 



GENERAL-CHECK(r) 

1. r < EXPAND(r); (0(n)) 

2. let -i(Ai |~ Bi), . . . , -^{Ak |~ Bk) be all negated conditionals in F; 
2.1. for alH = 1, . . . , fc result[i] < — CHECK(APPLY(r, -.(A, h B,))) ; 

3. if for all i = 1, . . . , fc result [i]==S AT then return SAT; 
else return UNSAT; 



By the subformula property, the number of negated conditionals which can occur 
in F is at most 0{n). Hence, the procedure GENERAL-CHECK calls to the algorithm 
CHECK at most 0{n) times. 

Theorem 3.24 Complexity of P. The problem of deciding validity for pref- 
erential logic P is cd^'P -complete. 

Proof. The procedure GENERAL-CHECK allows the satisfiability of a set of formulas 
of logic P to be decided in nondeterministic polynomial time. The validity problem 
for P is therefore in coNP. As coNP-hardness is immediate (this logic includes 
classical prepositional logic), we conclude that the validity problem for logic P is 
coNP-complete . 

■ 

This result matches the known complexity results for logic P [Lehmann and Magi- 
dor 1992]. Due to the coNP lower bound, the above method provides a computa- 
tionally optimal reasoning procedure for logic P. 

4. THE TABLEAU CALCULUS FOR LOOP CUMULATIVE LOGIC CL 

In this section we develop a tableau calculus TCL for CL, and we show that it can 
be turned into a terminating calculus. This provides a decision procedure for CL 
and a coNP-membcrship upper bound for validity in CL. 

The calculus TCL can be obtained from the calculus TP for preferential log- 
ics, by adding a suitable rule (L~) for dealing with the modality L introduced in 
section 2.3. As already mentioned in section 2.3, the formulas that appear in the 
tableaux for CL belong to the language Cl obtained from C as follows: (i) if A is 
propositional, then A ^ Cl; LA ^ Cl\ \I\^LA ^ Cl\ (H) if A, B are prepositional, 
then A \^ B ^ Cl\ {Hi) if T is a boolean combination of formulas oi Cl, then 
F G Cl. Observe that the only allowed combination of □ and L is in formulas of 
the form D-iLA where A is propositional. 
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r, A i~ s 

(i~+) 

r,^LA.Al~B r.^n^LA.A \~ B r,LB,Al~B 



r,^{A\~B) r,^a^LA 

— (°" 



LA, n^LA, ^LB, ri~='= r°, r'^'" , ri~='=, la, □-.la 



r,^LA r 

(L ) ' : if r docs not contain negated L-formulas 



Fig. 5. Tableau system TCL. If there are no negated L-formulas —^LA in the premise of [L ), 
then the rule allows to step from F to F^'^ . To save space, the boolean rules are omitted. 

We define: 

r^' = {A\LAer} 

Our tableau system TCL is sliown in Figure 5. Observe that rules (|~^) and (h~) 
have been changed as they introduce the modality L in front of the propositional 
formulas A and B in their conclusions. This straightforwardly corresponds to the 
semantics of conditionals in CL preferential models (see Definition 2.8). The new 
rule {L~) is a dynamic rule. 

Theorem 4.1 Soundness of TCL. The system TCL is sound with respect to 
CL-preferential models, i.e. if there is a closed tableau for a set of formulas T, then 
r is unsatisfiable. 

Proof. We show that for all the rules in TCL,, if the premise is satisfiable by a CL- 
preferential model then also one of the conclusions is. As far as the rules already 
present in TP are concerned, the proof is very similar, with the only exception that 
we have to substitute A in the proof by LA. 

We consider now the new rule {L~). Let A4,w \= T, -^LA where A4 = (W, R, < 
,V) is a CL-preferential model. Then there is w' : wRw' and A4,w' \= -^A. Fur- 
thermore, 7W, u'' ^ . It follows that the conclusion of the rule is satisfiable. If F 
does not contain negated L-formulas, since R is serial, we still have that 3w' : wRw' , 
and M.,w' ^ F^^, hence the conclusion is still satisfiable. 

■ 

Soundness with respect to loop-cumulative models in Definition 2.7 follows from 
the correspondence established by Proposition 2.9. 

The proof of the completeness of the calculus can be done as for the preferential 
case, provided we suitably modify the procedure for constructing a model for a 
finite consistent set of formulas F oi Cl- First of all, we modify the definition of 
saturated sets as follows: 

—if A h B e F then -^LA e F or -nO-^LA e F or LB e F 
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For this notion of saturated set of formulas we can still prove Lemma 3.6 for lan- 
guage Cl- 

Theorem 4.2 Completeness of TCL. TCL is complete with respect to CL- 
preferential models, i.e. if a set of formulas T is unsatisfiable, then it has a closed 
tableau in TCL. 

Proof. We define a procedure for constructing a model satisfying a consistent set of 
formulas To G £l by modifying the procedure for the preferential logic P. We add 
to the procedure used in the proof of Theorem 3.7 the new steps 4' and 4" between 
step 4 and step 5, obtaining the following procedure: 

1. initialize X = {SAT(ro)}; mark SAT(ro) as unresolved; 
while X contains unresolved nodes do 

2. choose an unresolved F from X; 

3. for each formula -^{A |~ B) £ F 

3a. let F^(Ai^fl) =SAT(APPLY(r, ^(A h B))); 
3b. if F^(^^^s) ^ X then X = XU {F^(^|^s)}; 

4. for each formula -^D^LA G F, let V^q^la =SAT(APPLY(F, -nB^LA)); 
4a. add the relation F^g^j^^ < F; 

4b. if F^n^i^ X then X = XU {F^d^^a}- 
4'. if {^LA j -nLA G F} / then 

for each -^LA G F, let T^la =SAT(APPLY(F, -^LA)); 
4' a. add the relation F R F^la; 
4' b. X = X U {r^LA}; 
4". else if F^^ / then let F' =SAT(APPLY(F, L~)); 
4" a. add the relation F i? F'; 
4" b. X = Xu{r'}; 

5. mark F as resolved; 
endWhile; 

This procedure terminates. Observe that, although an application of {L~) may 
introduce in X several copies of the same world (set) of propositional formulas, 
each of these worlds cannot lead to generate any further world by means of a 
dynamic rule. 

We construct the model M = {X,Rx, <x, V) by defining X and V as in the 
case of P. We then define Rx as the relation obtained from R augmented with the 
following conditions: 

(i) all the pairs (F, F) such that T E X and F has no i?-successor. 

(ii) all the pairs (F,F') such that (f",F) G R and (f",F') G R for some f"; 

Last, we define <x as follows: 

(in) if F' < F, then F' <x F; 

(iv) if F' < F, and TRxV" , then F' <x f"; 

(v) if F' <x F and F <x F", then F' <x F", i.e. <x is transitive. 

Notice that the above conditions on Rx and <x are needed since the procedure 
builds two different kinds of worlds: 

— bad worlds, obtained by an application of (L^)', 
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— good worlds: the other ones. 

Bad worlds are those obtained by an application of {L~). These worlds "forget" 
the positive conditionals in the initial set of formulas; for instance, if F = {"'C', D} 
is a bad world obtained from F' = {A \^ B,^LC, LD}, then it is "incomplete" 
by the absence of A |~ B. The above supplementary conditions on Rx and <x 
are needed in order to prove that, even in presence of bad worlds, we can build a 
CL-preferential model satisfying the initial set of formulas, as shown below by Fact 
4.3. 

It is easy to show that the following properties hold for M: 

Fact 4.3. For all r,r' e X, i/(F,F') e Rx and LAeT then A e V' . 

Proof of Fact 4.3. In case F ^ F', then (F,F') e R and it has been added to R 
by step 4' or step 4" of the procedure above. Indeed, for all (F, F') that have been 
introduced because (F ,T) € R and (F ,F') G R, both F and F derive from the 
application of (L^) to F , hence they only contain propositional formulas and do 
not contain any LA. 

Hence, we have two different cases: 

— the relation (F, F ) has been added to R by step 4': in this case, we have that 
-^LB G F. We can conclude that A £ F' by construction, since for each LA € F 
we have that ^ G F' as a result of the application of SAT (APPLY (F, -^LB) ) ; 

— the relation (F,F ) has been added to R by step 4": similarly to previous case, 
for each LA G F, we have that A is added to F by construction. 

In the case F = F', then it must be that (F, F) has been added to Rx, as F has no 
i?-successors. This means that F does not contain formulas of the form LA, -^LA, 
otherwise it would have an i?-successor. 

□ Fact 4.3 



Fact 4.4. For all formulas F and for all sets T £ X we have that: 
(i)ifFeT then M,T\= F; (ii) if^FeT then M,T^ F. 

Proof of Fact 4.4. The proof is similar to the one for the preferential case. If F is 
an atom or a boolean combination of formulas, the proof is the same as the proof 
for Fact 3.11 of the preferential case. We consider the following cases: 

— LA G F: we have to show that Al, F ^ LA, that is, we must show that, for all 
A G X, if (F, A) G Rx then M,A\= A. Let A be such that (F, A) G Then, 
by Fact 4.3, as LA G F, we can conclude A G A. By inductive hypothesis, then 
M,A^A. 

— -^LA G F: we have to show that M.,r ^ LA, that is, we must show that 
there exists A & X such that (r,A) G Rx and M,A ^ A. As ^LA G F, by 
construction (step 4' in the procedure) there must be a A G X such that -^A G A. 
By inductive hypothesis, Ai,A ^ A, which concludes the proof that J^,T ^ LA. 

—n^LA G F. Then, for all F, <x F we have -^LA G Fi by the definition of (D^), 
since F^ has been generated by a sequence of applications of (D^) (notice that 
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point (iv) in the definition of <x above does not play any role here, since this 

point only concerns sets of formulas F that are propositional and do not contain 

boxed or negated box formulas). By inductive hypothesis Ai,Ti ^ LA for all 

Ti <x r, whence M,T \= D^LA. 
— -iD-iLA e r. By construction there is a r' s.t. r' <x F and LA e T' . By 

inductive hypothesis M,T' ^ LA. Thus, M,T ^ O^LA. 
— A \^ B eT. Let A e Min<^^{LA). We distinguish two cases: 

— A ^ B e A, one can observe that {1)^LA e A or {2)^D^LA e A or 
{3)LB G A, since A is saturated. (1) cannot be the case, since by inductive hy- 
pothesis A4,A ^ LA, which contradicts the definition of Min<^^{LA). If (2), 
by construction of Ai there exists a set A <x A such that LA e A . By induc- 
tive hypothesis 7W, A |= LA, which contradicts A G Min^^{LA). Therefore, 
it must be that {3)LB G A, and by inductive hypothesis A4, A \= LB. 

— A |~ i? ^ A. Since all the rules apart from (L^) preserve the conditionals, 
A must have been generated by applying (L^) to A', i.e. A is a bad world. 
Hence, A'RxA. In turn, it can be easily shown that A' itself cannot have 
been generated by {L~), hence A \~ B E A', and, since A' is saturated, either 
{1)^LA G A' or {2)^a^LA G A' or {3)LB G A'. (1) is not possible, since by 
inductive hypothesis, it would entail that A4,A' ^ LA, i.e. there is A such 
that A RxA and Al, A ^ A. By point (ii) in the definition of Rx above, 
also ARxA , hence also M,A^ LA, which contradicts A G Min^^{LA). If 
(2), by construction of A4 there exists a set A <x A' such that LA G A . 
By point (iv) in the definition of <x above, A <x A, which contradicts 
A G Min^^{LA), since by inductive hypothesis Ai, A |= LA. It follows that 
LB G A'. By inductive hypothesis M,A' \= LB, hence also M,A \= LB 
(indeed, since A does not contain any L-formula, by construction of the model 
and by point (ii) in the definition of Rx above, ARxA just in case A' RxA , 
from which the result follows). 
Hence, we can conclude Ai,r \= A \^ B. 
— ->{A |~ B) G T: by construction of X, there exists T' e X such that LA, D^LA, ^LB G 

r . By inductive hypothesis we have that M.,T \= LA and M.V |= O^LA. It 

follows that r G Min^^(LA). Furthermore, always by induction, Ai,T ^ LB. 

Hence, M,T^A\^B. 

□ Fact 4.4 

Similarly to the case of P, it is easy to prove the following Fact: 

Fact 4.5. The relation <x is irreflexive, transitive, and satisfies the smoothness 
condition. 

Moreover: 

Fact 4.6. The relation Rx is serial. 

From the above Facts, we can conclude that Ai = {X, Rx , <x , ^) is a CL-preferential 
model satisfying Fq, which concludes the proof of completeness. 

■ 
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if r docs not contain negated L-formulas 



Fig. 6. The rule (L ) reformulated in TCl,'^ . 



From the above Theorem 4.2, together with Proposition 2.9, it follows that for any 
boolean combination of conditionals To, if it docs not have any closed tableau, then 
it is satisfiablc in a loop-cumulative model. 

Similarly to what done for P, we can prove the following Corollary. 

Corollary 4.7 Finite model property. CL has the finite model property. 
4.1 Decision Procedure for CL 

Let us now analyze the calculus TCL in order to obtain a decision procedure for 
CL logic. First of all, we reformulate the calculus as we have done for P, obtaining 
a system called TCL'^: we reformulate the (h'*') rule so that it applies only once 
to each conditional in each world, by adding an extra set E. We reformulate the 
other rules accordingly. Moreover, we adopt the same restriction on the order of 
application of the rules in Definition 3.14. 

Notice that the rule (L^) can only be applied a finite number of times. Indeed, 
if it is applied to a premise F, -iLA, then the conclusion only contains propositional 
formulas F^^, ^A, and the rule {L^) is no further applicable. The same in the case 
is applied to a premise r,LA. Notice that {L^) can also be applied to a set 
of formulas not containing any formula LA or -iLA: in this case, the conclusion of 
the rule corresponds to an empty set of formulas. Therefore, we reformulate {L~) 
only by adding the extra set S of conditionals; the reformulated rule is shown in 
Figure 6. 

Exactly as we made for P, we consider a lexicographic order given by m(F; S) = 
(ci, C2, C3, C4), and easily prove that each application of the rules of TCL"^ reduces 
this measure, as stated by the following Lemma: 

Lemma 4.8. Consider an application of any rule of TC'L'^ to a premise F; S 
and be F';E' any conclusion obtained; we have that either m(T';T.') < m(F; S) or 
TCJy^ leads to the construction of a closed tableau for F'; E'. 

Proof. Identical to the proof of Lemma 3.20. Just observe that if (L^) is applied, 
then ci, C2, and C3 become 0, since conditional formulas are not kept in the conclu- 
sion. If the premise contains only i-formulas, then ci, C2 and C3 are already equal 
to in both the premise and the conclusion, but C4 decreases, since (at least) one 
formula {-')LA in the premise is removed, and a formula with a lower complexity 
(-lA or A) is introduced in the conclusion. 

■ 

Thus, TCL'^ ensures termination. Furthermore, the decision algorithm for P de- 
scribed in section 3.1.2 can be adapted to CL. To this aim, we observe that the 
disjunction property holds for CL, and this allows us to change the rule for negated 
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conditionals in order to treat them independently as we have done for P. Moreover, 
we can replace the (□") rule by a stronger rule that does not require backtrack- 
ing in the tableau construction. The rule is the following (rE^ is used to denote 
{^n^LAj V LAj I -nO^LAj eT Aj ^ i}): 

r, -nD^LAi, -nD^LA2, -nO^LAn; S 

s,ri~=^,r°,r°\L^i,n^LAi,r°i ;0 I ... | i],ri~±,r°,r°',Lyi„,n^LAMr°„;0 

By reasoning similarly to what done for P, we can show that the calculus in which 
(□~) is replaced by (Dj) is sound and complete w.r.t. multi-linear CL-preferential 
models introduced in Definition 2.10. We get a decision procedure as for P, struc- 
tured in a top-level GENERAL-CHECK procedure, taking care of multiple negated 
conditionals, and in a CHECK procedure of tableau expansion. The procedure CHECK 
has to be modified by introducing steps 2' and 2" between steps 2 and 3 in the 
procedure for P as follows: 



CHECK(r) 

1. r < EXPAND(r); (0(n)) 

2. if r contains an axiom then return UNSAT; (0(n^)) 
2'. if {^LA I ^LA G r} ^ then 

2'a. for all -^LAi G T do result[i] < — CHECK (APPLYCF, ^LAJ ) ; 
2'b. if for some i result [i]==UNS AT then return UNSAT; 
2". else if {LA j LA G T} / then 

2" a. if CHECK (APPLY( T, L"))==UNSAT then return UNSAT; 

3. if {-iD^LA I -nO^LA G T} = then return SAT; 

4. else return CHECK ( APPLY (r, D^) ) ; 



The top-level procedure GENERAL-CHECK is the same as the one in section 3.1.2. For 
a better readability, we rewrite this procedure here below: 



GENERAL-CHECK(r) 

1. r < EXPAND(r); (0(n)) 

2. let -^{Ai |~ Bi), . . . , -^{Ak !~ Bk) be all negated conditionals in F; 
2.1. for alH = 1, . . . , fc result[i] < — CHECK(APPLY(r, -^{Ai h Bi))) ; 

3. if for alH = 1, . . . , fc result [i]==S AT then return SAT; 
else return UNSAT; 



Observe that the two recursive calls of CHECK in 2'a and 2" a do not generate further 
recursive calls. By this reason, we can argue similarly to what done for P, then we 
obtain the following result: 

Theorem 4.9 Complexity of CL. The problem of deciding validity for CL 
is colSiP -complete. 
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■ ii-*'^ ) on A y-^ B 




Fig. 7. A derivation of -.(A |~ C),A |~ B,B |~ A, S |~ C in TC. To save space, we use A to 
denote the set of positive conditionals A |~ S, S |~ A, B |~ C. 

5. THE TABLEAU CALCULUS FOR CUMULATIVE LOGIC C 

In order to provide a calculus for the weaker logic C, we have to replace the rule 
with the weaker (□*-'"): 



Observe that, if we ignore conditionals, this rule is nothing else than the standard 
rule of modal logic K. This rule is weaker than the corresponding rule of the two 
other systems in two respects: (i) transitivity is not assumed thus we no longer 
have in the conclusion; (ii) the smoothness condition does no longer ensure that 
if -lO-iLA is true in one world, then there is a smaller minimal world satisfying 
LA, this only happens if the world satisfies LA; thus O^LA is dropped from the 
conclusion as well. 

Moreover, we add the following form of cut: 

r 

(Weak-Cut) r— — p=t 

T,^LA r'^'^^r^ ,LA,a^LA r,a^LA 

Intuitively, this rule takes care of enforcing the smoothness condition, and it can 
be applied to all i-formulas. 

The (Weak-Cut) rule is not completely eliminable, as shown by the following ex- 
ample. Let r = {^{A |~ C), A\^ B,B |~ A, B |~ C}: the set F is unsatisfiable in C. 
r has a closed tableau only if we use (Weak-Cut) in the calculus, as shown by the 
derivation in Figure 7. Without (Weak-Cut), the above set of formulas does not 
have any closed tableau. 

The (Weak-Cut) rule makes the resulting calculus not analytic. However, the rule 
can be restricted so that it only applies to formulas LA such that A is the antecedent 
of a positive conditional formula in F, thus making the resulting calculus analytic. 
In order to prove this, we simplify the calculus by incorporating the application 
of {pP~) and the restricted form of (Weak-Cut) in the {y^^) rule. The resulting 
calculus, called TC and given in Figure 8, is equivalent to the calculus that would be 
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r, ^ i~ s 

(i^+) 

r,A\~B,^LA r'~ ,r'-'^ ,A \~ B,LA,n-,LA r,A \~ B.LA,n-.LA.LB 

r, -.(A|~_B) r,-.LA r 

(|~ ) {L ) ; if r does not contain negated L-formulas 



Fig. 8. Tableau system TC. The boolean rules are omitted. 

obtained from the calculus TCL by replacing (D^) with (O^^) and by introducing 
(Weak-Cut) restricted to antecedents of positive conditionals. The advantage of 
the adopted formulation is that, being more compact, it allows a simpler proof of 
the admissibility of the non-restricted (Weak-Cut) (see Theorem 5.2 below). 
Observe that the calculus does not contain any rule for negated box formulas, as 
the modified {\~~^) rule does no longer introduce formulas of the form -^D^LA. The 
resulting language Cl' of the formulas appearing in a tableau for C extends C by 
formulas LA and O-iLA where A is propositional, whereas negated box formulas 
of the form -^D^LA are not allowed. Therefore, Cl' is a restriction of Cl used in 
TCL. 

Notice also that, as a difference with TCL, the (|~^) rule is neither a static 
nor a dynamic rule. Indeed, the leftmost and rightmost conclusions of the rule 
represent the same world as the world represented by the premise, whereas the 
inner conclusion represents a world which is different from the one represented by 
the premise. 

We prove that TC is sound and complete w.r.t. the semantics. 

Theorem 5.1 Soundness of TC. The system TC is sound with respect to C- 
preferential models, i.e. if there is a closed tableau for a set of formulas T, then T 
is unsatisfiable. 

Proof. Given a set of formulas F, if there is a closed tableau for T, then F is unsat- 
isfiable in C-preferential models. For the rules already present in TCL, the proof 
is the same as the proof for Theorem 4.1 (notice that in the proof the transitivity 
of < does not play any role). We only consider here the rule (h"*"). We show that if 
the premise is satisfiable by a C-preferential model, then also one of the conclusions 
is. 

Let Ai, w \=T,A \~ B. We distinguish the two following cases: 

— A4,w LA, thus M.,w |= ^LA: in this case, the left conclusion of the (h^) 

rule is satisfied {M, w^V,A\^ B, -^LA); 
— M.,w 1= LA: we consider two subcases: 

— w e Min^{LA), hence M.,w |= LA, D-iLA . By the definition of M,w |= 
A |~ B, we have that hA,w |= LB. Therefore, the right conclusion of (|~+) is 
satisfiable; 

— w ^ Min^ {LA) : by the smoothness condition, there exists a world w < w such 
that w' £ Min^{LA). It follows that {M,w') |= LA,D^LA. Furthermore, by 
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the semantics of |~, (Ji4,w') \= and since w' < w, {A4,w') |= 

■ 

Soundness with respect to cumulative models follows from the correspondence es- 
tablished by Proposition 2.14. 

We can prove that the (Weak-Cut) rule is admissible in TC; this is stated by 
the following Theorem 5.2. The non-trivial proof of this Theorem is moved to the 
Appendix for space reasons. 

Theorem 5.2. Given a set of formulas T and a propositional formula A, if there 
is a closed tableau for each of the following sets of formulas: 

(1) T,^LA 

(2) T\~^ ,T°\ LA.D^LA 

(3) T,a^LA 

then there is also a closed tableau for T, i.e. the (Weak-Cut) rule is admissible. 

We prove the completeness of our calculus by modifying the procedure described 
in the proof of Theorem 3.7 above. The completeness is a consequence of the 
admissibility of the (Weak-Cut) rule. Hence, in the following completeness proof, 
we will make use of the (Weak-Cut) rule. We prove that given any finite Tq Q Cl', 
if it does not have any closed tableau, then it is satisfiable in a C-preferential model. 

In order to build a finite model for Tq, we consider a restricted version of 
only containing the formulas in C l' made out of propositional formulas appearing 
in Tq. We call this restricted language £ro- 

Theorem 5.3 Completeness of TC. TC is complete with respect to C-preferential 
models, i.e. if a set of formulas T is unsatisfiable, then it has a closed tableau in 
TC. 

Proof. We assume that no tableau for Tq is closed, and we construct a model for 

ro. 

Notice that the language Cr^ may contain infinitely many propositional formulas 
(obtained by boolean combinations of the atomic propositions in Tq). In order 
to keep the construction of the model finite, we define a notion of equivalence 
between formulas w.r.t. their propositional part (or p- equivalence) so to identify 
those formulas having the same structure and containing equivalent propositional 
components. Let =pc be logical equivalence in the classical Propositional Calculus. 
We define the notion of p- equivalence between two formulas F and G (written 
F =p G) as an equivalence relation satisfying the following conditions: 

— if F and G are propositional formulas, then F =p G iS F =pc G; 
—LA =p LB iff A =pc B; 
—^LA =p -nLB iSA=pc B; 
—D^LA =p n^LB iS A=pc B. 

For instance, LA =p L{A A A), U^LA =p D^L{A A A). 

We say that two sets of formulas F and F' are p-equivalent if for every formula 
in F there is a p-equivalent formula in F', and viceversa. 
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Observe that this notion of p-cquivalence is very weak and, for instance, we do 
not recognize that the set {LA, LB} is equivalent to the set {L{AaB)}. The notion 
of p-equivalcnce has been introduced with the purpose of hmiting the apphcation 
of the rule (Weak-Cut) so that it does not generate infinitely many equivalent 
formulas. Moreover, as we will see in the construction of the model below, this 
notion of equivalence will be used to control the addition of a new set of formulas 
to the current set of worlds. 

In our construction of the model below we will identify those p-equivalent sets of 
formulas T. Before adding a new set of formulas T to the current set of worlds X, 
we check that X docs not already contain a set T' which is p-equivalent to F; for 
short, we will write F X in the case X does not already contain such a F'. 

Wc define the procedure SAT' that for any F C C^^ extends F by applying the 
transformations described below and, at the same time, builds a set of formulas F"^ 
initially set to 0. The transformations below arc performed in sequence: 

— applies to F the propositional rules, once to each formula, as far as possible. 

In case of branching, makes the choice that leads to an open tableau (this step 

saturates F with respect to the static rules in C); 
— for each A |~ B G F, applies (h^) to it. If the leftmost branch is open, 

then adds -^LA to F; otherwise, if the rightmost branch is open, then adds 

O^LA, LA, LB to F; if the only open branch is the inner one, then adds the set 
^T^^ , LA,D^LA} to a support set F'^ associated with F, that is initially 

set to 0; 

— for all LA £ Cpg, if there is no A |~ i? G F, and there is no A' propositionally 
equivalent to A on which (Weak-Cut) has been previously applied (in F), applies 
(Weak-Cut) to it. If the leftmost branch is open, then adds -^LA to F; otherwise, 
if the rightmost branch is open, adds D^LA to F; if the only open branch is the 
inner one, then adds {F''^ ,r^\ LA,0^LA} to the support set F"^. 

Observe that SAT' terminates, extends F to a finite set of formulas, and produces a 
set which a finite set of finite sets of formulas, since: (a) there are only a finite 
number of conditionals that can lead to create sets of formulas in F"^; (b) there are 
only a finite number of p-equivalcnt formulas that can lead to create a set in by 
the third transformation above. 

We build X, the set of worlds of the model, and <, as follows: 

1. initialize X — {To}; mark To as unresolved; 

2. while X contains unresolved nodes do 

3. choose an unresolved F from X; 

4. for each {T^^"^ ,r°\ LA,a^LA} £ F^, associated to F, 

let Tla = S,kT{{V^^,T°\LA,U^LA}); 
4a. for all V £ X p-equivalent to Fla 

add the relation F' < F; 
4b. if Tla X then let X = X U {F^a} 

5. for each formula -^LA G F, let V^la =SAT' (APPLY(r, -.L^)); 
5a. for all F' G X equivalent to V^la 

add the relation F'^RF; 
5b. if F^LA X then let X = X U {F^la} 
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6. for each formula -^{A |~ B) £ F 

6a. let r^{A|^s) =SAT'(APPLY(r,^(A ^ B))); 
6b. if ^^(A^^B) X then X ^XU {r^(Ahs)}; 

7. mark F as resolved; 
endWhile; 

If To is finite, the procedure terminates. Indeed, it can be easily seen that SAT' 
terminates, as there is only a finite number of propositional evaluations. Further- 
more, the whole procedure terminates, since the number of possible different sets of 
formulas that can be added to X starting from a finite set Tq is finite. Indeed, the 
number of non-p-equivalent sets of formulas that can be introduced in X is finite, 
as the number of p-equivalent classes is finite. 

We construct the model = {X, Rx, <x, V) as follows. 

— X,V and Rx are defined as in the completeness proof for TCL (Theorem 4.2); 
— <x is defined as follows: 

(i) if r < r, then r' <x T; 

(ii) if r < r, and TRxT" , then T' <x t"; 

As a difference from <x used in the completeness proof for TCL (Theorem 4.2), 
<x is not transitive. 

In order to show that is a C-preferential model for F, we prove the following: 

Fact 5.4. The relation <x is irreflexive. 

Proof of Fact 5.4. By the procedure above, F' <x F only in two cases 1) F' = Tla- 
In this case, it can be easily seen that F ^ F'. 2) F' < F , i.e. F' = F^^, and 
F Rx^- Also in this case, it can be easily seen that F ^ F', since F does not 
contain L-formulas, whereas F' does. 

□ Fact 5.4 

By reasoning analogously to what done for Facts 3.11 and 4.4 above, we show that: 

Fact 5.5. For all formulas F and for all sets T d X we have that: 
(i) ifFeV then M,T ^ F; (ii) if^FeT then M,T^ F. 

Proof of Fact 5.5. The proof is very similar to the one of Facts 3.11 and 4.4 above. 
Obviously, the case of negated boxed formulas disappears. Here we only consider 
the case of positive conditional formulas since the rule (h"*") in TC is slightly 
different than before. Let A G Mm<^(LA). We distinguish two cases: 

— A \~ B <E A. By definition of SAT' and construction of the model above, either 
{1)^LA e A or (2) there is A^^ G X such that LA e Ala and Ala < A, 
hence Ala <x A or {3)LB G A. Similarly to what done in the proof for 
Fact 4.4, (1) and (2) cannot be the case, since they both contradict the fact that 
A G Min^^{LA). Thus it must be that {3)LB G A, and by inductive hypothesis 
Al, A h LB. 

— A \~ B ^ A. We can reason in the same way than in the analogous case in the 
proof of Fact 4.4 above: A must have been generated by applying (L^) to A' with 
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B & A' , hence A'RxA. By definition of SAT' above, eitlier {1)^LA e A' or 
(2) there is A^^ e X such that LA e A^^ and A'^^ < A', or (3) LB e A'. (1) is 
not possible: by inductive hypothesis, it would be Al, A' ^ LA, i.e. there is A 
such that ARxA and A4,A ^ A. By definition of Rx (see point (ii) in the 
definition of Rx, proof of Theorem 4.2), also Ai?xA , hence also A4, A ^ LA, 
which contradicts A G Min^^{LA). If (2), by definition of <x, A^^ <x A, 
which contradicts A G Min^^{LA). It follows that LB 6 A', hence by inductive 
hypothesis Ai,A'\^ LB, and also A^, A j= LB (indeed, since A does not contain 
any L— formula, by construction of the model and by definition of Rx - see point 
(ii) in the definition of Rx, proof of Theorem 4.2 - ARxA just in case A'RxA , 
from which the result follows). 

□ Fact 5.5 

Furthermore, we prove that: 

Fact 5.6. The relation < satisfies the smoothness condition on L-formulas. 

Proof of Fact 5.6. Let M,r \= LA. Then by Fact 5.5 above, -^LA ^ F. By 
definition of SAT' and point 4 in the procedure above, either D^LA e F or there is 
T' eX s.t. F' = Tla, and F' <x T. In the first case, by Fact 5.5, M,T ^ O^LA, 
and it is minimal w.r.t. the set of LA-worlds. In the second case A^,F \= D^LA, 
it is minimal w.r.t. the set of LA-worlds, and F <x F. 

□ Fact 5.6 



From the above Theorem 5.3, together with Proposition 2.14, it follows that for 
any boolean combination of conditionals Fq, if it does not have any closed tableau, 
then it is satisfiablc in a cumulative model. 

Similarly to what done for P and CL, we can show the following Corollary. 

Corollary 5.7 Finite model property. C has the finite model property. 

As a difference from P and CL we cannot prove that < does not have infinite 
descending chains. This is due to the fact that in the construction above we cannot 
prove that < is acyclic. 

In the case of logic C, non-termination can be caused by the generation of infinitely 
many worlds, producing infinite branches. By Theorem 5.2, only the formulas 
occurring in the initial set Fg of formulas can occur on a branch. Hence, the 
number of possibly different sets of formulas F on the branch is finite (and they are 
exponentially many in the size of Fq). A loop checking procedure can be used in 
order to avoid that a given set of formulas is expanded again on a branch, so to 
ensure the termination of the procedure. 

The satisfiability problem for a set of formulas Fq can be solved by showing that 
all the tableaux for Fq have an open branch. As there are exponentially many 
tableaux that have to be taken in consideration, each one of exponential size with 
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respect to the size of the initial set of formulas, our tableau method provides an 
hyper exponential procedure to check the satisfiability. 

In further investigations it might be considered if this bound can be improved. 
For this, a more accurate analysis of derivation structures (and, in particular, an 
analysis of permutability of the rules) might be required. 

6. THE TABLEAU CALCULUS FOR RATIONAL LOGIC R 

In this section we present TR, a tableau calculus for rational logic R. We have 
already mentioned that, as a difference with the calculi presented for the other 
weaker logics, here we adopt a labelled tableau calculus, which seems to be a more 
natural approach. Indeed, in order to capture the modularity condition, intuitively 
we must keep all worlds generated by (□") and we need to propagate formulas 
among them according to all possible modular orderings. In an unlabelled calculus, 
this might be achieved, for instance, by introducing ad hoc modal operators (that 
act as a marker) or by adding additional structures to tableau nodes similarly 
to hypersequents calculi (see for instance [Avron 1996]). However, the resulting 
calculus would be unavoidably rather cumbersome. In contrast, by using world 
labels, we can easily keep track of multiple worlds and their relations. This provides 
a much simpler, intuitive and natural tableau calculus. On the other hand, even if 
we use labels, we do not run into problems with complexity and termination, and 
we are able to define an optimal decision procedure for R. 

The calculus makes use of labels to represent possible worlds. We consider a 
language Cr and a denumerable alphabet of labels A, whose elements are denoted 
by X, y, z, .... Cr extends C by formulas of the form D-iA as for the other logics. 

Our tableau calculus includes two kinds of labelled formulas: 

— world formulas x : F, whose meaning is that F holds in the possible world 
represented by x; 

— relation formulas of the form x < y, where x,y E A, used to represent the relation 
<. 

We denote by a, /? . . . a world or a relation formula. 
We define: 

rf_, ^{y:^A,y:a^A\x: D^A e T} 

The calculus TR is presented in Figure 9. As for P, the rules (|~~) and (□") that 
introduce new labels in their conclusion arc called dynamic rules; all the other rules 
are called static rules. 

Definition 6.1 Truth conditions of formulas of TR. Given a model M = 
(yy, <, V) and a labelled alphabet A, we consider a mapping I : A ^-^ W. Given a 
formula a of the calculus TR, we define A4 \=i a as follows: 

-M Hx:FiffM,Iix)^F 
—M '^ix<y iffl{x) < I{y). 

We say that a set of formulas T is satisfiable if for all formulas a € T, we have 
that M 1=/ a, for some model M and some mapping I . 

ACM Transactions on Computational Logic, Vol. V, No. N, February 20YY. 



42 • Laura Giordano et al. 



(AX) r,x : P,x : with P G ATM (AX) T.x <y,y < x 



r,x:F^G r,x:^{FAG) 
(A + ) (A-) 



r,x : F,x : G r,x -.^F r,x -.^G 

r,x : -.-.F 



(-)■ 



r,x : F 



r, u : A l~ B 



r, X : ^A, u : A\~ B r,x : -^O^A, u : A \~ B T , x : B , u : A \~ B 



r, u : -^{A \~ B) X new T, x : -^U^A y now 

(|~-) label (□-) ■ label 

r,x : A,x : a^A, X : ^B r,y <x, r^'_^ y : A,y : O^A 



T , X <C y z occurs in F and 

(<) {x < z, z < y} nr = I 

r,x < y,z < y,r" ^ r,x < y,x < z,r"_^ 



Fig. 9. The calculus TR. To save space, rules for and V arc omitted. 

r : cr h- w^Vi : ^ : -»[a Am \^w) 
^ ' i^" ) 



y : -ta^y -.a,.. . x : a \^ w,y : : a,y : □-1a^^^ : : a Am, £ : □-'(a A jn),^ ; -lUf .. . hff ; : Uha 

J ; m, J ; □-■(a A ra), i : -■u' 

p-) 



I : a 1^ ^r",?^ < z^r ; a, r ; r : -"(ft Am), ^ : A m), 
2/ : ur, :ayy : 0-ia,y : m,s z : m^s : D-t{a A m)j2 : -lu? 



.. . ,r < f, < J, : Am), ...,j-<i,f<j(,r; -in.r :n-in,r :a 

9 : □-■(<!. Am),.. . ,jf I n.sr I m x 
-(A-) 



X X 



Fig. 10. A derivation in TR of {adult |~ worker, -•{adult |~ —•married), —•{adult A married |~ 
loorfcer)}. To save space, we use a for adult, m for married, and «) for worker. 

In order to verify that a set of formulas T is unsatisfiable, we label all the formulas 
in r with a new label xq, and verify that the resulting set of labelled formulas has 
a closed tableau. For instance, in order to verify that the set {adult |~ worker, 
-•{adult |~ -imarried), -i{adult A married h worker)} is unsatisfiable (and thus 
adult Amarried |~ worker is entailed by {adult worker, -i{adult \~ -imarried)}), 
we can build the closed tableau in Figure 10. 
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6.1 Soundness, Termination, and Completeness of TR 

In this section we prove that the calculus TR is sound and complete w.r.t. the 
semantics. Moreover, we prove that, with a restriction on (|~^) based on the same 
idea of the one adopted for the other calculi, the calculus guarantees termination. 

First of all, we reformulate the calculus, obtaining a terminating calculus TH^ . 
We will show in Theorem 6.11 below that, as for the calculi for P, CL, and C, 
non-termination of the procedure due to the generation of infinitely-many worlds 
(thus creating infinite branches) cannot occur. As a consequence, we will observe 
that only a finite number of labels are introduced in a tableau (Corollary 6.12). 

Similarly to the other cases, TR does not ensure a terminating proof search due 
to (h^), which can be applied without any control. We ensure the termination 
by putting on (|~^) in TR the same constraint used in the other calculi. More 
precisely, it is easy to observe that it is useless to apply the rule on the same 
conditional formula more than once by using the same label x. By the invertibility 
of the rules (Theorem 6.4) we can assume, without loss of generality, that two 
applications of (h"*") on x are consecutive. We observe that the second application 
is useless, since each of the conclusions has already been obtained after the first 
application, and can be removed. Wc prevent redundant applications of (h"*") by 
keeping track of labels (worlds) in which a conditional u : A ^ B has already been 
applied in the current branch. To this purpose, wc add to each positive conditional 
a list of used labels; we then restrict the application of (|~^) only to labels not 
occurring in the corresponding list. 

Notice that also the rule (<) copies its principal formula x < y in the conclusion; 
however, this rule will be applied only a finite number of times. This is a conse- 
quence of the side condition of the rule application and the fact that the number 
of labels in a tableau is finite. 

The terminating calculus TR'^ is obtained by replacing the (|~^) rule in Figure 
9 with the one presented in Figure 11. 



r,n: A |~ 

r,x :^A,u:A\~B'^''' T, x ; -.□-.A, « : A |~ B^'^ r,x : B,u : A \~ B'^''' 
with X ^ L 



Fig. 11. The rule (|~+) in the tableau system TUT- . 

It is easy to prove the following structural properties of TR'^: 

Lemma 6.2. For any set of formulas F and any world formula x : F, there is a 
closed tableau for T , x : F, x : -iF. 

Proof. By induction on the complexity of the formula F. 

Lemma 6.3 Height-preserving admissibility of weakening. Given any set 
of formulas F and any formula a, if T has a closed tableau of height h then T,a 
has a closed tableau whose height is no greater than h. 
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Proof. By induction on the height of the closed tableau for F. 

Moreover, one can easily prove that all the rules of TR"^ are height-preserving 
invertible, that is to say: 

Theorem 6.4 Height-preserving invertibility of the rules of TRJ. Given 
any rule (R) o/TR'^, whose premise is T and whose conclusions are Ti, with i < 3, 
we have that ifV has a closed tableau of height h, then there is a closed tableau, of 
height no greater than h, for each Ti, i.e. the rules o/ TR'^ are height-preserving 
invertible. 

The proof is in the Appendix. Since all the rules are invertible, we have that in 
TR"^ the order of application of the rules is not relevant. Hence, no backtracking is 
required in the calculus, and we can assume without loss of generality that a given 
set of formulas T has a unique tableau. 
Let us now prove that TR'^ is sound. 

Theorem 6.5 Soundness. TR'^ is sound w.r.t. rational models, i.e. if there 
is a closed tableau for a set of formulas T, then T is unsatisflable. 

Proof. By induction on the height of the closed tableau for F. If F is an axiom, 
then we distinguish two different cases. First case: a; : P G F and x : -iP G F, 
therefore there is no / such that I{x) G W and M,I{x) ^ P and M,I{x) ^ P, 
and F is unsatisflable. Second case: a; < y G F and y < a; G F, therefore there is a 
cycle in the preference relation, and the smoothness condition cannot be satisfied. 
Indeed, since in any rational model < is irreflexive an transitive, it can be easily 
shown that there cannot be an / such that I{x) < I{y) and I{y) < I{x), which 
makes F unsatisflable. 

For the inductive step, we have to show that, for each rule r, if all the conclusions 
of r are unsatisflable, then the premise is unsatisflable too. As usual, we prove the 
contrapositive, i.e. we prove for each rule that, if the premise is satisfiable, so 
is (at least) one of the conclusions. In order to save space, we only present the 
most interesting case of (□"). Since the premise is satisflable, then there is a 
model Ai and a mapping / such that A4 \=i F, x : -^O^A. Let w G W such that 
I{x) = w; this means that M,w ^ D^A, hence there exists a world w' < w such 
that A4,w' ^ A. By the strong smoothness condition, we have that there exists a 
minimal such world, so we can assume that w' G Min<^{A), thus A4,w' \= D^A. In 
order to prove that the conclusion of the rule is satisflable, we construct a mapping 
/' as follows: let y be a new label, not occurring in the current branch; we deflne 
(1) I'{u) = I{u) for &\\ u ^ y and (2) /'(y) = w' . Since y does not occur in F, it 
follows that M 1=/' F. By Definition 6.1, we have that M y < x since w' < w. 
Moreover, since I'{y) = w' , we have that Ai \=i' y : A and Ai \=i' y : O^A. Finally, 
Ai \=i' F^j, follows from the fact that I'{y) < I'{x) and from the transitivity of 
<. The only conclusion of the rule is then satisfiable in Ai via /'. 

■ 

In order to prove the completeness of the calculus, we introduce the notion of 
saturated branch and we show that TR"^ ensures a terminating proof search. As a 
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consequence, we will observe that the calculus introduces a finite number of labels 
in a tableau, and this result will be used to prove the completeness of the calculus. 

Definition 6.6 Saturated branch. We say that a branch B = Ti, . . . , r„ 
of a tableau is saturated if the following conditions hold: 

( 1 ) for the boolean connectives, the condition of saturation is defined in the usual 
way. For instance, if x : A A B Ti m B, then there exists Tj in B such that 
X : A £Tj and x : B (^Tj; 

(2) if X : A \^ B (1 Ti, then for any label y in B, there exists Tj in B such that 
either y : -lA G Tj or y : -iQ-iA G Tj or y : B G Tj . 

(3) if X : ~'{A |~ B) G Ti, then there is a Tj in B such that, for some y, y : A d Tj, 
y : n^A G Tj, and y : ^B eTj. 

(4) if X : -iQ-iA G Ti, then there exists Tj in B such that, for some y,y<x£Tj, 
y : AeTj and y : D^A G Tj. 

(5) if X < y G Ti, then for all labels z in B, there exists Tj in B such that either 
z < y eTj or X < z ETj. 

We say that a branch B = Fi, . . . , r„, . . . is open if there is no Ti in B such that 
X : F ^Ti and x : ^F G Ti. We can easily show the following Lemma: 

Lemma 6.7. Given a tableau starting with xq : F , for any open, saturated branch 
B = Fi, . . . , r„, . . we have that: 

(1) if z < y G Ti in'B and y < x E Tj in B, then there exists Tk in B .such that 
z < X e Ffc,- 

(2) if X : 0-1 A G Fi m B and y < x GTj in B, then there exists F^ in B such that 
y.^A&Tk andy: U^A G F^; 

(5) for noTi m B, x < x ^Ti. 

The proof is in the Appendix. Also in TR"^ we introduce the restriction on the 
order of application of the rules adopted for the other systems (see Definition 3.14), 
that is to say: the application of the (D^) rule is postponed to the application of 
all propositional rules and to the test of whether F is an instance of (AX) or not. 

Let us now show that TR'^ ensures a terminating proof search. In order to 
prove this result in a rigorous manner, we proceed as follows: first, we introduce 
the complexity measure on a set of formulas F of Definition 6.9, denoted by m{T), 
which consists of five measures ci,C2,C3,C4 and C5 in a lexicographic order, and 
the auxiliary Definition 6.8; then, we prove that each application of TR'^'s rules 
reduces this measure, until the rules are no longer applicable, or leads to a closed 
tableau. 

The complexity of a formula cp{F) is defined in Definition 3.18; moreover, we 
use square brackets [. . .] to denote multisets. 

Definition 6.8. Given an initial set of formulas Tq, we define: 

— the set of boxed formulas D^A that can be generated in a tableau for Tq, i.e. 

C^°^ = {n^A \A^Be+ To} U {a^A \A^Be_ To}. We let no =\ C^°+ \; 
— the multiset of negated boxed formulas that can be generated in a tableau 

for To, I.e. C^"_ = [-^D^A \ A ^ B e+ To]. We let ko =| \; 
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Given a label x and a set of formulas T in the tableau for the initial set Fq, we 
define: 

— the number Ux of positive boxed formulas Q-iA not labelled by x, i.e. Ux = na~ \ 

{O^A G I X : D^A G T} |; 
— the number kx of negated boxed formulas -lO-iA not yet expanded in a world x, 

i.e. kx fco- I hO^A G | y : n^A eV andy <x£T] \^ . 

Definition 6.9 Lexicographic order. We define m{T) — (01,02,03,04,05) 
where: 

—01 =1 {m : A h S G_ r} 

— C2 is the multiset given by [cjS 02^, . . . , C2"], where xi, X2, . . . , a;„ are the labels 
occurring in T and, given a label x, C2 is a pair (n^;, k^) in a lexicographic order 
(ux and kx are defined as in Definition 6.8). We consider the integer multiset 
ordering given by C2 

— C3 =1 {(x, A |~ B) I u : A |~ B-^ G r and x ^ L] \ 

— 04 = o|, where z occurs in T and =| {a; < y G F | {x < z, z < j/} fl F = 0} 
We consider the lexicographic order given by m(F). 

Roughly speaking, ci is the number of negated conditionals that can still be ex- 
panded in the tableau. The application of (h~) reduces ci. C2 keeps track of 
positive conditionals which can still create a new world. The application of (□") 
reduces 02. 03 represents the number of positive conditionals not yet expanded in 
a world x: the application of (h"*") reduces this measure, since the rule is applied 
to u : A |~ by using x only if x does not belong to L, i.e. u : A B has 
not yet been expanded in x. C4 represents the number of relations x < y not yet 
added to the current branch: the application of (<) reduces 04, since it applies the 
modularity of < in case x < y and, given z, neither z < y nor x < z belong to the 
current set of formulas. C5 is the sum of the complexities of the world formulas in 
F: an application of the rules for boolean connectives reduces 05. 

First of all, we prove that the application of any rule of TR"^ reduces 7n(F) or 
leads to a closed tableau, as stated by the following Lemma: 

Lemma 6.10. Let F' be a set of formulas obtained as a conclusion of an appli- 
cation of a rule o/TR'^ to a set of formulas F. We have that either the tableau for 
F' is closed or m(F') < to(F). 

Proof. We consider each rule of the calculus: 

— an application of this rule reduces Ci, since it is applied to a negated 
conditional u : -'{A |~ B) belonging to its premise which is removed from the 
conclusion; 

^Notice that, in case there are two positive conditionals A |~ _B and A |~ C with the same 
antecedent, then the multiset contains two instances of -iD-iA. Therefore, if the rule (□") 

is applied to x : -iD-iA (for instance, generated by an application of (|~~'') in a; on A |~ B), then 
kx decreases only by 1 unit, whereas the second instance of ^D^A, i.e. the one "associated" with 
A |~ C, is still considered to be not expanded in x, thus it still "contributes" to k^. 
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— first of all, observe that ci is not augmented in the conclusion, since no 
negated conditional is added by the rule. The application of (□") reduces C2 or 
leads to a closed tableau. We are considering the following rule application: 

r,a; : -nO^A 

n 

r,y <x,r^ly,y:A,y:a^A 

where y is a new label. C2 in the premise, say C2p, is a multiset [. . . , cf ,...], 
whereas in the conclusion we have to consider a measure, called , of the form 
[. . . , cf ^ , cl^ , . . .] . By the standard definition of integer multiset ordering, we prove 
that either C2^ < C2p (by showing that cf ^ < cf^ and c^^ < cf^ , i.e. we replace an 
integer C2 with two smaller integers, see [Dershowitz and Manna 1979] for details 
on integer multiset orderings) or that the procedure leads to a closed tableau. 
We conclude the proof as follows: 

— let us consider and cf^. By definition, c^^ is a pair {ny^,ky^) and cf^ is 
a pair (ux^jk^^)- We distinguish two cases: if x : D^A ^ F, then we easily 
prove that ny^ < n^p, since y : O-iA belongs to the conclusion: therefore, 
the number of boxed formulas O-iA not occurring with label y is smaller than 
the number of boxed formulas not occurring with label x, and we are done 
(remember that all the positive boxed formulas labelled by x are also labelled 
by y in the conclusion, by the presence of T^{^y); if x : O^A G F, then the 
application of (D^) leads to a node containing both y : A and y : -^A and, by 
the restriction on the order of application of the rules (see Definition 3.14), the 
procedure terminates building a closed tableau; 

— let us consider and . It is easy to observe that n^^, = n^^, since no 
formula x : O-iA is added nor removed in the conclusion (the positive boxed 
formulas labelled by x are the same in both the premise and the conclusion). 
We conclude since k^^ < k^ , since x : -^D^A has been expanded in x, so it 
"contributes" to k^^ whereas it does not to k^^. 

— (l~^): first of all, notice that ci and C2 cannot be higher in the conclusions than in 
the premise. Notice that the addiction of a; : -iQ-iA in the inner conclusion docs 
not increase C2, since -^D^A is a negated boxed formula still to be considered 
in both the premise and the conclusions. The application of (|~"^) reduces C3. 
Suppose that this rule is applied tou : A \^ by using label x in the conclusions; 
by the restriction in Figure 11, this means that x ^ L, so {x,A |~ B) belongs 
to the set whose cardinality determines C3 in the premise. Obviously, since x 
is added to L for u : A \~ B in the three conclusions of the rule, we can easily 
observe that {x,A |~ B) does no longer belong to the set in the definition of C3 
in the conclusions: C3 is then smaller in the conclusions than in the premise, and 
we are done; 

— (<): the application of (<) reduces C4, whereas ci, C2, and C3 cannot be aug- 
mented (at most formulas z : O^A arc added in the conclusions by F^l^^ and 
F^^, reducing C2). To conclude the proof, just observe that, given a label z and 
a formula x < y, (<) is applied if {x < z, z < j/} n F = 0, i.e. x < y belongs to 
the set used to define cf in the premise, say cf^. When the rule is applied, in the 
left premise z < y is added, and x < y does no longer belong to the set used to 
define c| in the conclusion, say c|^. Therefore, < c|^. The same for the right 
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premise, and we are done; 
— rules for the boolean connectives: these rules do not increase values of ci, C2, 
C3, and C4. Their application reduces C5, since the (sum of) complexity of the 
subformula(s) introduced in the conclusion(s) is lower then the complexity of the 
principal formula to which the rule is applied. 

■ 

Now we can prove that TR"^ ensures a terminating proof search: 

Theorem 6.11 Termination of TR'^. LetT be a finite set of formulas, then 
any tableau generated by TR"^ is finite. 

Proof. Let F' be obtained by an application of a rule of TR'^ to a premise T. By 
Lemma 6.10 we have that either the procedure leads to a closed tableau (and in this 
case we are done) or we have that TO(r') < TO(r). This means that, similarly to the 
case of P, a finite number of applications of the rules leads cither to close the branch 
or to a node whose measure is as follows: (0, [(0, 0), (0, 0), . . . , (0, 0)], 0, 0, C5„;„), 
where cs^^^^ is the minimal value that C5 can assume for T. This means that no rule 
of TR"^ is further applicable. This is a consequence of the following facts: 

— (|~~) is no longer applicable, since ci ~ 0; 

— since C2 = [(0, 0), (0, 0), ... , (0, 0)], given any label x, we have that = (0, 0). 

Therefore, the (□") rule is no longer applicable, since we can observe that there 

is no X : -^D^A G F (by the fact that fcx = 0); 
— the rule (H"*") is not further applicable since C3 = 0; indeed, C3 = means that 

all formulas A l~ _B have already been expanded in each world x; 
— C4 = 0, i.e. for all formulas x < y, given any label z, we have that either z < y € T 

ov X < z & r, thus the (<) rule is not further apphcable; 
— since C5 assumes its minimal value Cs,^^^ , no rule for a boolean connective is 

further applicable. If a boolean rule is applicable, then its application reduces 

the value of C5 in its conclusion(s) by Lemma 6.10, against the minimality of 

cSinmin the premise. 

■ 

As a consequence of Theorem 6.11, we can observe that the tableau for a given set 
of formulas Fq contains a finite number of labels, since all the branches in a tableau 
generated by TR"^ are finite. 

Corollary 6.12. Given a set of formulas F, the tableau generated by TR'^ for 
F only contains a finite number of labels. 

Let us now show that TR"^ is complete with respect to the semantics: 

Theorem 6.13 Completeness. TR"^ is complete w.r.t. rational models, i.e. 
if a set of formulas F is unsatisfiable, then it has a closed tableau in TUT- . 

Proof. We show the contrapositive, i.e. if there is no closed tableau for F, then F is 
satisfiable. Consider the tableau starting with the set of formulas {x : F such that 
-F G F} and any open, saturated branch B = Fi, F2, . . . , F„ in it. Starting from B, 
we build a canonical model Ad = (VV_b, <, V) satisfying F, where: 
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— Wb is the set of labels that appear in the branch B; 

— for each x,y G Wb, x < y iS there exists Ti in B such that x < y E Ti] 

—for each x eWb, V{x) ^ {P e ATM \ there is in B such that x: P eV,}. 

We can easily prove that: 

(i) by Corollary 6.12, we have that Wb is finite; 

(m) < is an irreflexive, transitive and modular relation on Wb satisfying the smooth- 
ness condition. Irreflexivity, transitivity and modularity are obvious, given Defini- 
tion 6.6 and Lemma 6.7 above. Since < is irreflexive and transitive, it can be easily 
shown that it is also acyclic. This property together with the finiteness of Wb 
entails that < cannot have infinite descending chains. In turn this last property 
together with the transitivity of < entails the smoothness condition. 
(Hi) We show that, for all formulas F and for all Ti in B, (i) if a; : G then 
Ai,x \= F and (ii) if x : ^F G then M,x ^ F . The proof is by induction on the 
complexity of the formulas. If F G ATM this immediately follows from definition 
of V . For the inductive step, we only present the case oi F = A \^ B. The other 
cases are similar and then left to the reader. Let x : A\^ B E Ti. By Definition 6.6, 
we have that, for all y, there is Tj in B such that either y : ^A G Tj or y : B € Tj or 
y : -.□-.A G Tj. We show that for all y G Mm<(A), M,y\^B. Let y G Min<(A). 
This entails that M,y ^ A, hence y : -^A ^ Tj. Similarly, we can show that 
y : -iQ-iyl ^ Tj. It follows that y : B G Tj, and by inductive hypothesis A4,y \= B. 

(ii) If X : -^{A |~ B) G Ti, since B is saturated, there is a label y in some Tj such 
that y : A G Tj, y : O-iA G Tj, and y : -iB G Tj. By inductive hypothesis we can 
easily show that M,y |= A, M,y ^ D^A, hence y G Mm<(A), and M,y ^ B, 
hence M,x ^ A\~ B. 

Since TR'^ makes use of the restriction in Figure 11, we have to show that this 
restriction preserves the completeness. We have only to show that if (h"*") is applied 
twice on the same conditional A |~ B, in the same branch, by using the same label 
X, then the second application is useless. Since all the rules are invertible (Theorem 
6.4), we can assume, without loss of generality, that the two applications of (h"*") 
are consecutive. We conclude that the second application is useless, since each of 
the conclusions has already been obtained after the first application, and can be 
removed. 

■ 

By Theorem 6.5 above and by the construction of the model done in the proof of 
Theorem 6.13 just above, we can show the following Corollary. 

Corollary 6.14 Finite model property. R has the finite model property. 
6.2 Decision Procedure and Optimal Proof Search for R 

In this section we define a systematic procedure which allows the satisfiability prob- 
lem for R to be decided in nondetcrministically polynomial time, in accordance with 
the known complexity results for this logic. 

Let n be the size of the starting set F of which we want to verify the satisfiability. 
The number of applications of the rules is proportional to the number of labels 
introduced in the tableau. In turn, this is 0(2") due to the interplay between the 
rules (|~^) and (D^). Hence, the complexity of the calculus TR'^ is exponential in 
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n. 

In order to obtain a better complexity bound for validity in R we provide the fol- 
lowing proeedure. Intuitively, we do not apply (□") to all negated boxed formulas, 
but only to formulas y : -D^A not already expanded, i.e. such that z : A^z : \3^A 
do not belong to the current branch. As a result, we build a small model for the 
initial set of formulas in accordance with Theorem 2.2. This is made possible by 
the modularity of < in R. 

Let us define a nondeterministie procedure CHECK (F) to decide whether a given 
set of formulas F is satisfiable. Let EXPAND(F) be a proeedure that returns one 
saturated expansion of F w.r.t. all static rules. In ease of a branching rule. EXPAND 
nondeterministieally selects (guesses) one conclusion of the rule. 



CHECK(r) 

1. r < EXPAND(r); 

2. if r contains an axiom then return UNSAT; 

3. r < result of applying (|~~) to each negated conditional in F; 

4. r < EXP AND (r); 

5. if r contains an axiom then return UNSAT; 

while r contains a y : —C\-^A not marked as CONSIDERED do 

6. select y : -.□-.A G T not already marked as CONSIDERED; 
6a. if there is z in F such that z : A £ F and z : O—^A £ F 

then 6a'. add z <y and T^L,^ to F; 

else 6a". F < result of applying (□") to y : ^D^A; 

6b. mark y : ^D^A as CONSIDERED; 

7. F < EXPAND{F); 

8. if F contains an axiom then return UNSAT; 
endWhile 

9. return SAT; 



Observe that the addition of the set of formulas z < y, F^^ in step 6a' could be 
omitted and it has been added mostly to enhance the understanding of the proee- 
dure. Indeed, the rule (<), which is applied at each iteration to assure modularity, 
already takes care of adding such formulas. The procedure CHECK nondeterministi- 
eally builds an open branch for F. 

Theorem 6.15 Soundness and completeness of the procedure. The above 
procedure is sound and complete w.r.t. the semantics. 

Proof. {Soundness). We prove that if the initial set of formulas F is satisfiable, 
then the above procedure returns SAT. More precisely, we prove that each step of 
the procedure preserves the satisfiability of F. As far as EXPAND is concerned, notice 
that it only applies the static rules of TR"^ and the soundness follows from the fact 
that these rules preserve satisfiability (see Theorem 6.5). Consider now step 6. Let 
y : -^\I\^A the formula selected in this step. If (□") is applied to y : -D^A (step 
6a") we are done, since (□") preserves satisfiability (see Theorem 6.5). If F already 
contains z : A,z : D^^, then step 6a' is executed, and the relation z < y is added. 
In this case we reason as follows. Since F is satisfiable, we have that there is a 
model M and a mapping / such that (1) M,I{y) \= -^D^A and (2) M,I{z) 1= A 
and M,I{z) \= D^A. We can observe that I{z) < I{y) in M. Indeed, by the 
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truth condition of -iQ-iA and by the strong smoothness condition, we have that 
there exists w such that w < I{y) and M,w \= A,D^A. By modularity of <, 
either 1. w < I{z) or 2. I{z) < I{y). 1 is impossible, since otherwise we would 
have Ai,w \= -^A, which contradicts j\4,w ^ A. Hence, 2 holds. Therefore, we can 
conclude that step 6a' preserves satisfiability. 

(Completeness) . It can be easily shown that in case the procedure above returns 
SAT, then the branch built is saturated (see Definition 6.6). Therefore, we can build 
a canonical model for the initial T, as done in the proof of Theorem 6.13. 

■ 

Theorem 6.16 Complexity of the CHECK procedure. By means of the pro- 
cedure CHECK the satisfiability of a set of formulas of logic R can be decided in 
nondeterministic polynomial time. 

Proof. Observe that the procedure generates at most 0(n) labels by applying the 
rule (|~~) (step 3) and that the while loop generates at most one new label for each 
-iQ-iA formula. Indeed, the rule (□") is applied to a labelled formula y : -iQ-iA 
to generate a new world only if there is not a label z such that z : A ^ T and 
z : D-iA £ r are already on the branch. In essence, the procedure does not add 
a new minimal A-world on the branch if there is already one. As the number of 
different -iQ-iA formulas is at most 0(n), then the while loop can add at most 
0{n) new labels on the branch. Moreover, for each different label x, the expansion 
step can add at most 0{n) formulas x : -iQ-iA on the branch, one for each positive 
conditional A \^ B occurring in the set T. We can therefore conclude that the while 
loop can be executed at most 0{n^) times. 

As the number of generated labels is at most 0{n), by the subformula property, 
the number of labelled formulas on the branch is at most 0{n^). Hence, the ex- 
ecution of step 6a has complexity 0{n^). The execution of the nondeterministic 
procedure EXPAND has complexity 0{n^), including a guess of size O(n^), whereas 
to verify if T contains an axiom has complexity 0{n^) (since it requires to check 
whether, for each labelled formula x : P E the formula x : -iP is also in T, and 
r contains at most O(n^) labelled formulas). We can therefore conclude that the 
execution of the CHECK procedure requires at most 0{n^) steps. 

■ 

By Theorem 6.16, the validity problem for R is in coNP. coNP-hardness is 
immediate, since R includes classical propositional logic. Thus, we can conclude 
that: 

Theorem 6.17 Complexity of R. The problem of deciding the validity for 
rational logic R is coNP -complete. 

7. CONCLUSIONS 

In this paper, we have presented tableau calculi for all of the KLM logical systems 
for default reasoning. Some preliminary results have been presented in [Giordano 
et al. 2005] and [Giordano ct al. 2006]. Wc have given a tableau calculus for 
rational logic R, preferential logic P, loop-cumulative logic CL, and cumulative 
logic C. The calcuh presented give a decision procedure for the respective logics. 
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Moreover, for R, P and CL we have shown that we can obtain coNP decision 
procedures by refining the rules of the respective calcuh. In case of C, wc obtain a 
decision procedure by adding a suitable loop-checking mechanism. Our procedure 
gives an hyper exponential upper bound. Further investigation is needed to get 
a more efficient procedure. On the other hand, wc arc not aware of any tighter 
complexity bound for this logic. 

All the calculi presented in this paper have been implemented by a theorem 
prover called KLMLean. KLMLean (not presented here) is a SICStus Prolog im- 
plementation of the tableau calculi introduced in this paper, and it is inspired to the 
"lean" methodology [Beckert and Posegga 1995; Fitting 1998; Beckert and Posegga 
1996], whose basic idea is to write short programs and exploit the power of Prolog's 
engine as much as possible. To the best of our knowledge, KLMLean is the first 
theorem prover for KLM logics. 

Artosi, Governatori, and Rotolo [Artosi et al. 2002] develop a labelled tableau 
calculus for C. Their calculus is based on the interpretation of C as a conditional 
logic with a selection function semantics. As a major difference from our approach, 
their calculus makes use of labelled formulas, where the labels represent possible 
worlds or sets of possible worlds. World labels in turn are annotated by formulas to 
express minimality assumptions, e.g. they represent by a label the fact that w is 
a minimal A-world, or in terms of the selection function, belongs to f{A,u). They 
use then a sophisticated unification mechanism on the labels to match two anno- 
tated worlds, e.g. w"^, w^; observe that by CSO (which is equivalent to CUT-I-CM), 
the equivalence of A and B might also be enforced by the conditionals contained in 
a tableau branch. Even if they do not discuss decidability and complexity issues, 
their tableau calculus should give a decision procedure for C. 

In [Giordano et al. 2003] and [Giordano et al. 2005] it is defined a labelled tableau 
calculus for the logic CE and some of its extensions. The flat fragment of CE corre- 
sponds to the system P. The similarity between the two calculi lies in the fact that 
both approaches use a modal interpretation of conditionals. The major difference 
is that the calculus presented here docs not use labels, whereas the one proposed 
in [Giordano et al. 2003] does. A further difference is that in [Giordano et al. 2003] 
the termination is obtained by means of a loop-checking machinery, and it is not 
clear if it matches complexity bounds and if it can be adapted in a simpler way to 
CL and to C. 

Lchmann and Magidor [Lehmann and Magidor 1992] propose a non-deterministic 
algorithm that, given a finite set K of conditional assertions C,; |~ Di and a condi- 
tional assertion A \~ B, checks if A |~ _B is not entailed by K in the logic P. This 
is an abstract algorithm useful for theoretical analysis, but practically unfeasible, 
as it requires to guess sets of indexes and propositional evaluations. They conclude 
that entailment in P is coNP, thus obtaining a complexity result similar to ours. 
However, it is not easy to compare their algorithm with our calculus, since the two 
approaches arc radically different. As far as the complexity result is concerned, 
notice that our result is more general than theirs, since our language is richer: we 
consider boolean combinations of conditional assertions (and also combinations with 
propositional formulas), whereas they do not. As remarked by Boutilicr [Boutilicr 
1994], this more general result is not an obvious consequence of the more restricted 
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one. Moreover, we prove the coNP result also for the system CL. At the best of 
our knowledge, this result was unknown up to now. 

We plan to extend our calculi to first order case. The starting point will be the 
analysis of first order preferential and rational logics by Friedman, Halpcrn and 
KoUer in [Friedman et al. 2000]. 
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Appendix with Proofs 

Proof of Theorem 2.2. For any T Q C, if T is satisfiable in a rational model, then 
it is satisfiable in a rational model containing at most n worlds, where n is the size 
ofT, i.e. the length of the string representing T. 

Let r be satisfiable in a rational model = (W, <, V), i.e. Ai, Xq \= T for some 
xo e W. We build the model M' = (W, <', V) as follows: 

— We build the set of worlds W" by means of the following procedure: 

(1) W ^ {xoh 

(2) for each A, h e_ T do 

— choose Xi E W s.t. Xi G Min^{Ai) and J^,Xi ^ Bf, 
—W' < — W U {xj; 

(3) for each A, h B, e+ T do 

if Min^{Ai) ^ 0, and there is no Xi s.t. Xi G Min^(Ai) and 
Xi is already in W' then 
— choose any Xi € Min^{Ai); 
—W' < — W U {x,}; 
— For all Xi, Xj G W, we let Xi <' Xj if Xi < Xj] 
—For aU x, G W, we let V'{x,) ==V{x,). 
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In order to show that W' is a rational model satisfying F, we can show the 
following Faets: 

Fact A.l. |W| < n. 

Proof of Fact A.l. The proof immediately follows by construction of W. 

□ Fact A.l 



Fact A. 2. A4' is a rational model, since <' is irreflexive, transitive, modular 
and satisfies the Smoothness Condition. 

Proof of Fact A. 2. Irreflexivity, transitivity and modularity of <' obviously follow 
from the definition of <'. The Smoothness Condition is ensured by the fact that 
<' does not have infinite descending chains, since < does not have. 

□ Fact A. 2 



Fact A. 3. For all Xi G W, for all propositional formulas A, Ai,Xi \= A iff 
M',x,\^A. 

Proof of Fact A. 3. By induction on the complexity of A. 

□ Fact A. 3 



Fact A. 4. For all Xi € M' , for all formulas A s.t. A is the antecedent of some 
conditional occurring in T, we have that Xi € Min<:'{A) iff Xi € Min^{A). 

Proof of Fact A. 4. First, we prove that if Xi G Afm</(A), then Xi G Min^{A). 
Let Xi G Min^'{A). Suppose that Xi ^ Mm<(A). Since A is the antecedent of a 
conditional in F, by construction of W', W contains Xj, Xj ^ Xi, s.t. Xj G Afm<(A) 
in A4. Since A4,Xi \= A and Xj G Min^{A), we have that Xj < Xi. By Fact A. 3, 
M.' , Xj \= A, and by the definition of <', Xj <' Xi, which contradicts the assumption 
that Xi G Min'^ {A) . We conclude that Xi G Min^ {A) in M . 

Now we prove that \i Xi G Mm<(A), then Xi G Mm</(A). Let Xi G Min^{A) in 
M.. Suppose that Xi ^ Afm</(A). Then there is Xj s.t. M.' ,Xj ^ A and Xj <' Xi. 
By Fact A. 3 (since A is a propositional formula), also Ai, Xj ^ A, and by definition 
of <', Xj < Xi, which contradicts the assumption that Xi G Mm<(A). Hence, 
Xi G A/m</(A). 

□ Fact A. 4 



Fact A. 5. For all conditional formulas {~')A |~ B occurring in T, if A4,xo \= 
{-n)A h B, then M', xq \= {-^)A h B. 

Proof of Fact A. 5. We distinguish the two cases: 
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— M,xo 1= ^{A |~ B): by construction of W', there is Xi G W" s.t. Xi E Min^{A) 
and M,Xi y= B. By Facts A. 3 and A. 4, Xi e Min^i{A) and M',Xi ^ B, hence 
M'.xq h -(-4 h -B). 

— ^ ^ h consider any Xi S Mm<'(A), by Fact A. 4 Xi S Mm<(yl), hence 
AljXj 1= B, and, by Fact A.3, M',Xi \= B. We conclude that M' ,xq \= B. 

□ Fact A. 5 

By the Facts above, we have shown that F is satisfiable in a rational model con- 
taining at most n worlds, hence the Theorem follows. 



Proof of Theorem 2.6. Let F be any set of formulas, ifT is satisfiable then it has a 
multi-linear model. 

Let us make explicit the negated conditionals in F by rewriting it as 

F = F',-(Ci hZ?i),...,-(Cfc h Dk). 

Assume F is satisfiable, then there is a model Ai ~ (W, <, V) and x G W, such that 
M, a; 1= F. We have that there are yi, . . . ,yk G W, such that for each j — 1, . . . ,k, 

yj e Min<:{C'j) and M,yj ^ Dj 

We define for x and each yj: 

Wa: = {zeW\z<x}U {x} 

Wy^={zGW\z<y,}'j{y,} 

Moreover, we consider for each j = 1, . . . , fc a renaming function (i.e. a bijection) 
fj whose domain is Wyj that makes a copy Wy^(j,^.) of Wy- which is (i) disjoint 
from Wa;, (ii) disjoint from any Wj,, , and (iii) disjoint from any other W^, (y,) with 
I ^ j. Observe that we make k disjoint sets VV^^.^j,^) even if some y^'s coincide 
among themselves or coincide with x. We define a model M.' = (W, <', V) as 
follows: 

The relation <' is defined as follows: 

u <' V iff (i) u,v £ Wx and u < v, 
or (ii) u,v € VV/^(j,^) so that u ~ fj{z) and v = fjiw) 

where z,w £ Wy^ and z < w. Observe that elements in different components (i.e. 
Wx or yVyj) are incomparable w.r.t. <'. 

Finally, we let V'{z) = V{z) for z G Wx and for u G y^fj{yj) with u = fj{w), we 
let V'{u) = V{w). 

We prove that A4',x \= F. The claim is obvious for propositional formulas and 
for (negated) boxed formulas by definition of Wx ■ 
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Fig. 12. A preferential model satisfying a set of formulas F. Edges represent the preference relation 
< {u < x,v < u, and so on). 

For any negated conditional ^(Cj |~ Dj), we have that yj G Min^{Cj) and 
M,yj y= Dj. By definition of M' wc get that M'Jjiyj) h Cj and M'Jjiyj) ^ 
Dj] we have to show that there is no w S 'y^fj(yj) such that u <' fj{yj) and 
A4',u \= Cj. But if there were a such u, we would get that u = fj{z) for some 
z £ yVj,^ with z < yj and , z |= against the minimality of yj . 

For any positive conditional in F, say E |~ F, let u S Min^{E): if ti G Wx it 
must be w G Min^{E) thus 1= F. If w G then u = fj{z) for some 

z G Wj,^ ; it must be z G Min^{E), for otherwise if it were z' < z with Ai, z' \= E, 
since z' G Wy- we would have fj{z') < u and 7W, fj{z') \= E against the minimality 
of u. Thus z G Min^{E) and then tM, z \= F, and this imphes TW', u\= F. 

We now define a multi-linear model Mi = (VV",<i,y) as follows: we let <i 
be any total order on and on each VV'j^(j^^.) which respects <'; the elements in 
different components remain incomparable. More precisely <i satisfies: 

— if u <' V then u <i v 

— for each u,v G Wx (u, v G VV/^.(j,^)) with u ^ v, u <i v or v <i u 

— for each u G Wx, v G W/^.(j,^),u fti v and v u 

— for each u G Wf.f^y-^^v G Wf-(^y-), with i j u fti v and v fii u 

In Figure 13 we show an example of multi-linear model, obtained by applying 
the above construction to the model represented in Figure 12. 
We show that A4i,x \= F. For propositional formulas the claim is obvious. For 
positive boxed- formulas we have: if D-iA G F, and z <i x, then z G Wx, thus 
z <' a;, and the result follows by A4' ,x ^ F. For negated boxed formulas, we 
similarly have: -^D^A G F, then M' , x \= -iQ-iA, thus there exists z <' x such that 
Ai' , z \=: A, but z <' X implies z <i x and we can conclude. 

For negated conditionals, let -^{Cj \~ Dj), we know that A4',x ^ ~^{Cj h Dj), 
witnessed by the Cj-minimal element fj{yj)- Since the propositional evaluation is 
the same, we only have to check that fj{yj) is also minimal w.r.t. <i. Suppose it 
is not, then there is z G VV/^.(.y^) with z <i fj(yj) such that A4i,z ^ Cj, but we 
would get z <' fjii/j) against the minimality of fj{yj)- 
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Fig. 13. A multi-linear model obtained by means of the construction described in the proof of 
Theorem 2.6. Edges represent the preference relation <i. The empty edge has been added to 
let <i be a total order. In order to have that elements in different components are incomparable 
w.r.t. <i, in the rightmost component the world z has been renamed in y" . 

For positive conditionals in F, say E |~ let u S Min^^(E). It must be also 
u £ AIin^-^{E), for otherwise, if there were v <' u, such that A4',v \= E then we 
would get also v <i u and M.i,v \= E, against the minimality of m in Aii. 



Proof of Proposition 2.9. A boolean combination of conditional formulas is sat- 
isfiable in a loop-cumulative model M. = {S,W ,1, <,V) iff it is satisfiable in a 
CL-preferential model M' = (W, R, <', V). 

The Proposition immediately follows from the following Lemma: 

Lemma A. 6. A set of conditional formulas {{-i)Ai |~ Bi, . . . , {-i)An |~ i?ri} is 
satisfiable in a loop- cumulative model Ad = {S,yV ,1, <,V) iff it is satisfiable in a 
CL-preferential model M' = {W, R, <', V). 

First, we prove the only if direction. Let M = (S*, W, 1,<,V) be a loop-cumulative 
model, and s e 5 s.t. {M,s) \= {{-')Ai h BJ. 

We build a CL-preferential model M' = (W, i?, <', V) as follows: 

— W = {(s,w) -.seS and w e /(s)}; 

— (s, w)R{s, w') for aU (s, w), (s, w') € W; 
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— {s,w) <' {s',w') if s < s'; 
—V'{s,w) = V{w). 

Observe that for each s G S* there is at least one corresponding {s,w) 6 W", since 
l{s) ^ 0. From the fact that < in Ai is irreflexive and transitive it immediately 
follows by construction that also <' in Ai' satisfies the same properties. We show 
in Fact A. 11 below that <' satisfies the smoothness condition on L-formulas. 

The relation R is serial, since it is reflexive. 

Fact A. 7. For every propositional formula A we have that (A4,s) |= A iff 
{M\{s,w)) h LA. 

Proof of Fact A. 7. (^)Let(A^,s) \= A. By definition, for all w £ ^(s), (X, w) |= A. 
By induction on the complexity of A, we can easily show that {M.\ {sjW)) \= A. 
Since R{s,w) = {(s,w') | w' € l{s)}, it follows that (A^',(s,w)) LA. 
{<=) Let {M', (s, w)) \= LA. Then, for aU (s, w') £ R{s, w), {M', (s, w')) h A. By 
definition of M' it follows that for ah w' e l{s), {M, w') A. Hence, (A^, s) \= A. 

□ Fact A.l 



Fact A. 8. s e Min<{A) in M iff {s,w) G Min<^,{LA) in M' . 

Proof of Fact A. 8. (^) Let s e Min^{A) in M. Consider (s,w) in M' . By 
Fact A. 7, [M' ,{s,w)) ^ LA. By absurd, suppose there exists a (s',u>') s.t. 
{M',{s',w')) h LA, and (s',w') < (s,w). By Fact A.7, (7W,s') |= A, and 
s' < s by construction, which contradicts the fact that s G Mm<(A) in A4. Hence 
(.s,w) e Min^,{LA) in X'. 

(^) Let (s, u;) S Min^,{LA) in TW. Consider s in M. By Fact A.7, {M,s) \= A. 
Furthermore there is no s' < s s.t. {Ai,s') \= A. By absurd suppose there was 
such a s'. By construction of Ai', and by Fact A.7, {M' , {s' ,w')) ^ LA, and 
(s', w') < (s, w), which is a contradiction. Hence s G Min<(y4). 

□ Fact A. 8 



Fact A. 9. For every conditional formula A \~ B we have that 
{M, s) \=A\^B iff {M', {s, w)) h A h B. 

Proof of Fact A.9. {=>) Let {M,s) \= A h B. Then for aU s' G Min^{A), 
{M,s') 1= B. By Facts A.7 and A.8, it follows that for all [s' ,w') G Min<,{LA), 
\m', (s', w')) 1= LB, hence {M' , (s, w)) ^A\^B. 

(<^) Let (7W',(s,w)) A h B. Then, for aU {s' ,w') G Min'^{LA), {M',{s',w')) h 
XB. By Facts A.7 and A.8 it follows that for all s' G Min^{A) in M, {M, s') \= B. 
Hence, {M,s) |= A h S. 

□ i^aci A.9 



Fact A. 10. For every negated conditional formula -^{A |~ B) we have that 
[M, s) 1= ^{A h B) iff {M', {s, w)) h -(A h S). 
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Proof of Fact A.IO. {^) Let {M, s) \= -n{A |~ B). Then there is an s' G Afm<(A) 
s.t. M,s' ^ B. Consider {s',w') in M' . By Facts A.7 and A.8 (s',w') £ 
Min<,{LA) and {M',{s',w')) ^ LB. Hence, (7W',(s,w;)) ^^{A\r.B). 
(^) Let (A^', (s,-u;)) ^ -.(A h 5)- Then, there is a (s',u;') G Min'^{LA) s.t. 
(A^', (s', w')) ^ LB. Consider s' in A^. From Facts A.7 and A.8 we conclude that 
s' G Min<{A), and (X,s') ^ B. Hence {M,s) \= ^{A h B). 

From Facts A. 9 and A.IO we conclude that [M' , {s,w)) ^ h -Bj}- Fur- 

thermore, we show that <' satisfies the smoothness condition on L-formulas. 

Fact A. 11. <' satisfies the smoothness condition on L-formulas. 

Proof of Fact A.ll. Let {M' , {s,w)) ^ LA, and {s,w) ^ Min<,{LA). By Fact A.7 
{Ai,s) 1= A, and by Fact A.8, s ^ Min^{A) in M. By the smoothness condition 
in Ai there is s' such that s' G Min^{A) and s' < s. Consider any {s',w') G Ai' . 
By Fact A.8 (s',w') G Min^,{LA), and by definition of <', (s',w') <' (s, w). 

□ fact ^.ii 

Let us now consider the if direction. Let the set of conditionals {{^)Ai |~ Bj} be 
satisfied in a possible world w in the CL-prefcrential model M = (W, i?, <, y). We 
build a Loop-Cumulative model A4' = {S, W, I, <', V) as follows (i?ti; is defined as 
Rw = {w' eW\ {w,w') G R}): 

—S = \weW}] 

— /((w, /iu')) = Rw; 

— {w, Rw) <' (w', Rw') if w < w'; 

—V'{w) = V{w). 

From the fact that < in is transitive and irreflexive, it follows by construction 
that <' in M' is transitive and irreflexive. As far as the smoothness condition, see 
Fact A. 15 below. Furthermore, for all {w,Rw) G 5", l{w,Rw) ^ 0, since R is serial. 
We now show that (X', (it;, Rw)) |ee {{-^)Ai h Bj}. 

Fact A. 12. For A propositional, {M,w) \= LA iff {M' , {w , Rw)) \= A. 

Proof of Fact A.12. {=>) Let {M,w) |= LA. Then for all w' G Rw, M,w' |= A. 
By definition of M' , it follows that for all w' G l{w,Rw), M',w' ^ A. Hence 
{M',{w,Rw)) 1= A. 

{<=) Let {M',{w,Rw)) 1= A Then, for aU w' G l{w,Rw), {M' ,w') h ^- By 
induction on A, we show that for all w' G Rw, [M, w') \= A, hence (A4, w) \= LA. 

□ Fact A.12 



Fact A. 13. w G Min<{LA) in M iff {w,Rw) G Mm</(A) m At'. 
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Proof of Fact A. 13. Let w e Min^{LA) in M. Consider {w,Rw). By Fact 

A. 12 {M', {w, Rw)) 1= A. Furthermore, suppose by absurd there was {w' , Rw') s.t. 
iM', lw\Rw')) \= A, and {w',Rw') <' {w,Rw). Then in M, M,w' h LA and 
w' < w, which contradicts the fact that w G Min<:{LA). It follows that in Ai' , 
{w,Rw) G Min<'{A). 

(-4=) Let {w,Rw) e Min<'{A) in M'. Consider w in M. By Fact A. 12, {M,w) |= 
LA. By absurd, suppose there was a w' s.t. A4,w' \= LA and w' < w. By Fact 
A. 12, {M' , {w' , Rw')) 1= A, and {w',Rw') <' (WjRw), which contradicts the fact 
that {w,Rw) G Afm</(A). It follows that w e Mm<(Lyl) in M. 

□ Fact 

We can reason similarly to what done in Facts A. 9 and A. 10 above to prove the 
following Fact: 

Fact A. 14. For every conditional formula {~')A |~ B we have that {A4,w) \= 
HA h B iff {M', {w, Rw)) 1= HA h B. 

We conclude that {M' , (w, Rw)) \= {HAi |~ B{\. 

Furthermore, we show that <' satisfies the smoothness condition: 

Fact A. 15. <' satisfies the smoothness condition on L-formulas. 

Proof of Fact A.15. Let {M',{w,Rw)) |= A and {w,Rw) ^ Mm</(A) in M' . 
By Facts A.12 and A.13, {M,w) ^ LA and w ^ Min<{LA) in M. By the 
smoothness condition on i-formulas in A^, it follows that in Ai there is w' < w s.t. 
(M,w') 1= LA and w' G Min<{LA). Consider {w',Rw') in M' . By Facts A.12 
and A.13 (A4', {w'.Rw')) |= A and {w',Rw') G Mm<'(A) in A^'. 

□ Fact A.15 



Proof of Lemma 3.6. Given a consistent finite set of formulas T, there is a consis- 
tent, finite, and saturated set T' D T. 

Consider the set F* of complex formulas in F such that there is a static rule that 
has not yet been applied to that formula in F. For instance, if F = {P |~ Q, ^{R 
S),R, -.S*, i? V T, -'□-'Q}, then F* = {P h Q}., since neither nor -.□-.P nor Q, 
resulting from an application of the static rule (|~"'") to P \~ Q, belong to F. 

If F* is empty, we are done. Otherwise, we construct the saturated set F' as 
follows: 1. initialize F' with F; 2. choose a complex formula F in F* and apply the 
static rule corresponding to its principal operator; 3. add to F' the formula(s) of 
(one of) the consistent conclusions obtained by applying the static rule; 4. update 
r*^ and repeat from 2. until F* is empty. This procedure terminates, since in 

"The complex formula analyzed at the current step must be removed from F* and formulas 
obtained by the application of the static rules that fulfill the definition of F* must be added. 
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all static rules the conclusions have a lower complexity than the premise; a brief 
discussion on the (h"*") rule: from the premise ^ |~ S we have the following possible 
conclusions: -^A, -^O^A and B. If -iQ-iA is introduced, then no other static rule 
will be applied to it. Since A and B are boolean combinations of formulas, then 
the other applications of static rules to them will decrease the complexity. 

Furthermore, each step of the procedure preserves the consistency of F. Indeed, 
each conclusion of the rule applied to F corresponds to a branch of a tableau for F. 
If all the branches were inconsistent, F would have a closed tableau, hence would 
be inconsistent, against the hypothesis. 



Proof of Proposition 3.17. Given a pair Fq; 0, where Fq is a set of formulas of C, 
all the tableaux obtained by applying TP^ 's rules only contain regular nodes. 

Given a regular node F; S and any rule of TP"^, we have to show that each conclu- 
sion of the rule is still a regular node. The proof is immediate for all the proposi- 
tional rules, for (□") and for (h~)j since no negated box formula not belonging to 
their premise is introduced in their conclusion(s). Consider now an application of 
(^^"'") to a regular node F', A \~ B; S: one of the conclusions is F', -iQ-iA; E, A \~ B, 
and it is a regular node since there is A \~ B in the auxiliary set of used conditional 
in correspondence of the negated boxed formula -iQ-iA. 



Proof of Theorem 5.2 (Admissibility of (Weak-Cut) in TC) 

In order to prove in Theorem 5.2 below that (Weak-Cut) is admissible in TC, we 
need to prove some Lemmas. 

First of all, we prove that weakening is height-preserving admissible in our tableau 
calculi, i.e. if there is a closed tableau for a set of formulas F, then there is also a 
closed tableau for F, F (for any formula F of the language) of height no greater than 
the height of a tableau for F. Moreover, weakening is cut-preserving admissible, in 
the sense that the closed tableau for F, F does not add any application of (Weak- 
Cut) to the closed tableau for F. Furthermore, we prove that the rules for the 
boolean connectives are height-preserving and cut-preserving invertible, i.e. if there 
is a closed tableau for F, then there is a closed tableau for any set of formulas that 
can be obtained from F as a conclusion of an application of a boolean rule. 

Lemma A. 16 Height-preserving and cut-preserving admissibility of weakening. 
Given a formula F , if there is a closed tableau of height h for T , then there is also 
a closed tableau for F,_F of no greater height than h, i.e. weakening is height- 
preserving admissible. Moreover, the closed tableau for F, F does not add any ap- 
plication of (Weak-Cut) to the closed tableau for T, i.e. weakening is cut-preserving 
admissible. 

Proof. By induction on the height h of the closed tableau for F. 
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Lemma A. 17 Height-preserving and cut-preserving invertibility of boolean rules. 
The rules for the boolean connectives are height-preserving invertihle, i.e. given a 
set of formulas T and given any conclusion V , obtained by applying a boolean rule 
to T , if there is a closed tableau of height h for T , then there is a closed tableau 
for V of height no greater than h. Moreover, the closed tableau for F' does not add 
any application of (Weak-Cut) to the closed tableau for T, i.e. the boolean rules are 
cut-preserving invertible. 

Proof. For each boolean rule (R), we proceed by induction on the height of the 
closed tableau for the premise. As an example, consider the (V+) rule. We show 
that, a T,F V G has a closed tableau, also F, F and F, G have. If F, V G is an 
instance of the axiom (AX), then there is an atom P such that P G F and -^P € F, 
since axioms are restricted to atomic formulas only. Therefore, F has a closed 
tableau (it is an instance of (AX) too), and we conclude that both T,F and F, G 
have a closed tableau, since weakening is height-preserving admissible (Lemma A. 16 
above). For the inductive step, we consider the first rule in the tableau for F, FVG. 
If (V"*") is applied to F V G, then we are done, since we have closed tableaux for 
both r,F and F, G of a lower height than the premise's. If (h~) is applied, then 
F V G is removed from the conclusion, then F has a closed tableau; we conclude 
since weakening is height-preserving admissible (Lemma A. 16). If a boolean rule is 
applied, then F V G is copied into the conclusion(s); in these cases, we can apply 
the inductive hypothesis and then conclude by re-applying the same rule. As an 
example, consider the case in which (^~) is applied to T',^{H I),F y G as 
follows: 

T',^(H -> /),FVG 

— (^-) 

{*)T',H,^I,FV G 

By the inductive hypothesis, there is a closed tableau (of no greater height than 
the height of (*)) for (**)F', -i/, F and for (* * *)T',H,^I,G. We conclude as 
follows: 

(**)r',F,-j,F 

r,^(g^/),G 
(* * *)r',H, -^i,G 



If the first rule of the closed tableau for F, F V G is (|~^) applied to A \^ B E T, 
then we have the following situation: 

F,FVG 

1 \ — ■ (h+) 

(1)F,FVG,-Fyl (2)fI~ ,F° ,L^,n^L^ {3)r, F V G, LA,D^LA, LB 

By the inductive hypothesis on (1), we have closed tableaux for (l')r, F, ^LA and 
for (l")r, G, -^LA. By the inductive hypothesis on (3), we have closed tableaux for 
(3')F, F, LA, n^LA, LB and for (3")F, G, LA, D^LA, LB. We conclude as follows: 

F,F 



(l')F,F,^FA (2)F'^",r°^LA,n^FA {3')T, F, LA,n^LA, LB 
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r,G 



(h+) 



{l")r, G,^LA {2)r~ ,LA,n^LA {■r)r,G,LA,a^LA,LB 

If F (resp. G) were a conditional formula (even negated), we conclude as above, re- 
placing the inner conclusion with rl"^'' , , F, LA, D^LA (rcsp. rl~* , , G, LA, D^LA), 
for which there is a closed tableau since weakening is height-preserving admissible 
(Lemma A. 16). 



Now we prove that we can assume, without loss of generality, that the conclusions of 
(Weak-Cut) are never derived by an application of (|~^), as stated by the following 
Lemma: 

Lemma A. 18. IfT has a closed tableau, then there is a closed tableau for F in 
which all the conclusions of each application of (Weak- Cut) are derived by a rule 
different from ( h ^ ) . 

Proof. Consider an application of (Weak-Cut) in F in which one of its conclusions 
is obtained by an appHcation of (h")- The appHcation of (Weak-Cut) is useless, 
since the premise of the cut can be obtained by applying directly (|~^) without 
(Weak-Cut). For instance, consider the following derivation, in which the inner 
conclusion of (Weak-Cut) is obtained by an appHcation of (h^): 

r',-.{c h D) 

• (Weak-Cut) 

r',^(c h D),^LA r'i~±,r'° ,-.{c h D),LA,n^LA r',-.{c i- D),n-.LA 

— (I--) 

{*)r'l~±, LC, □-.LC, -.LD 

We can remove the application of (Weak-Cut), obtaining the following closed 
tableau: 

F',-(GhZ?) 

(l~") 



{*)T''^'^ , LC,a^LC,^LD 



Obviously, the proof can be concluded in the same way in the case the leftmost (resp. 
the rightmost) conclusion of (Weak-Cut) has a derivation starting with (|~~). 



Now we prove that cut is admissible on prepositional formulas and on formulas of 
the form LA. By cut we mean the following rule: 

F 

(Cut) 

r,F T,^F 

and we show that it can be derived if is a prepositional formula or a formula of 
kind LA. 

Lemma A. 19. Given a set of propositional formulas F and a propositional for- 
mula A, if there is a closed tableau for both {l)V,-iA and (2)F,^ without (Weak- 
Cut), then there is also a closed tableau for F without (Weak-Cut). 

Proof. Since F is propositional, the only applicable rules are the propositional rules. 
The result follows by admissibility of cut in tableaux systems for propositional logic. 
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Lemma A. 20. If there is a closed tableau without (Weak-Cut) for (l)r, -iLA and 
for (2)r, LA, then there is also a closed tableau without (Weak-Cut) for T. 

Proof. Let hi be the height of the tableau for (1), and h2 the height of the tableau 
for (2). We proceed by induction on hi + h2. 

Base Case: hi -\- h2 = 0. In this case, hi = and h2 = 0. In this case, (1) and (2) 
contain an axiom, and since axioms are restricted to atomic formulas, it can only 
be that P, ^P G F, where P E ATM. Therefore, we conclude that there is a closed 
tableau for F without (Weak-Cut). 

For the inductive step, we show that if the property holds in case hl + h2 = rt — 1, 
then it also holds in case hl + h2 ~ n. We reason by cases according to which is the 
first rule applied to (1) or to (2). If the first rule applied to (1) is applied to 

a conditional ^(C \~ D) € F, let 1'^(c\^d) be the set of formulas so obtained. It can 
be easily verified that the same set can be obtained by applying the same rule to the 
same conditional in F, hence F has a closed tableau without (Weak-Cut). If the first 
rule applied to (1) is (h"*"), applied to a conditional (C |~ D) G F, then we have that 
(la)F, ^LC, -^LA, {lb)T^^ , F°^ , LC, D^LC, and (lc)r, LC, D^LC, LD, ^LA have 
a closed tableau with height smaller than hi. We can then apply weakening and the 
inductive hypothesis first over (2) and (la) and then over (2) and (Ic), to obtain that 
(i)r, -iLC, and (ii) F, LC, D-iLC, LD respectively have a closed tableau without 
(Weak-Cut). Since (i),(lb),(ii) arc obtained from F by applying (h^) on C |~ D, 
we conclude that also F has a closed tableau without (Weak-Cut). The case in which 
the first rule applied is a propositional rule immediately follows from the height- 
preserving invertibility of the boolean rules (see Lemma A. 17 above). For instance, 
suppose (l)F', LAG, ^LA is derived by an application of (A+), i.e. (l')r', L, G, ^LA 
has a closed tableau of height smaller than hi. Since (2)F', FAG, LA has a closed 
tableau, and (A"'") is height-preserving invertible, then also {2')r' , F,G, LA has a 
closed tableau of height no greater than h2, and we can conclude as follows: 

F',LAG 

— (A+) 

r',L,G 

(cut) 

{l')T',F,G,^LA {2')r',F,G,LA 

If the first rule applied to (2) is either a propositional rule, or (h^), or (h^), we 
can reason as for (1). We are left with the case in which the first rule applied both 
to (1) and to (2) is (L"). 

If the first rule applied to (1) is (L~), applied to -^LB e F, let F^lb be the set 
obtained. The same set can be obtained by applying (L^) to -^LB in F, hence F 
has a closed tableau without (Weak-Cut). If (L~) is applied to -^LA itself, then 
(*)F-^'^ , -lA has a closed tableau. In this case, wc have to consider the tableau 
for (2). We distinguish two cases: in the first case (L~) in (2) has been applied to 
some -iLB G F, in the second case F does not contain any negated L formula, hence 
(L~) has not been applied to any specific -^LB. First case: {**)V^^ ,^B,A has a 
closed tableau. By weakening from (*), also {*')T^\ -^B, -^A has a closed tableau. 
By Lemma A. 19 applied to (*') and (**), also T^\^B has a closed tableau, and 
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since this set can be obtained from T by applying {L~) to -^LB, it follows that F 
has a closed tableau, without (Weak-Cut). Second case: (* * *)T^\A has a closed 
tableau. By Lemma A. 19 applied to (*) and (* * *), also F^^ has a closed tableau, 
and since this set can be obtained by applying (L^) to F, it follows that F has a 
closed tableau, without (Weak-Cut). 

■ 

Lemma A.21. Let LA and LB be such that there is a closed tableau without 
(Weak-Cut) for {LA, ^LB}. Then for all sets of formulas T, if F, U^LA, D^LB 
has a closed tableau without (Weak-Cut), also T,D-iLB has. 

Proof. By induction on the height h of the tableau for F, D^LA, O^LB. If ft, = 0, 
then F, D-iLA, O-iLB contains an axiom, hence (since axioms only concern atoms), 
also F does, and there is a tableau for T,O^LB without (Weak-Cut). We prove 
that if the property holds for all tableaux of height ft. — 1, then it also holds for 
tableaux of height h. We proceed by considering all possible cases corresponding 
to the first rule applied to F, O^LA, D^LB. 

The case in which the first rule is boolean is easy and left to the reader. 

If the first rule is (i~), it can be easily verified that the same set of formulas can 

be obtained by applying (£") to F, D^LB that hence has a closed tableau without 

(Weak-Cut). 

If the first rule is (h~), again it can be easily verified that the same set of formulas 
can be obtained by applying {\~~) to F, D-iii?, that hence has a closed tableau 
without (Weak-Cut). 

If the first rule is (h+) apphcd to a conditional C h G F, then (1)F, D^LA, U^LB, ^LC; 
{2)T\~^ ,T'^\^LA,^LB,D^LC,LC; {3)r, D^LA,D^LB, D^LC, LC, LD have a 
closed tableau with height smaller than ft. By the inductive hypothesis from (1) 
and (3), we infer that (l')F, D^LB, ^LC and (3')F, U^LB, D^LC, LC, LD have a 
closed tableau without (Weak-Cut). Furthermore, since by hypothesis {LA,^LB} 
has a closed tableau without (Weak-Cut), from (2), weakening (Lemma A. 16), and 
Lemma A. 20, we infer that also (2')fI'^ , F'-''^ , LC, D^LC, ^LB has a closed tableau 
without (Weak-Cut). Since (1'), (2'), (3') can be obtained from F, O^LB by apply- 
ing |~+ to C |~ -D in F, we conclude that F, D^LB has a closed tableau without 
(Weak-Cut). 

There are no other cases, hence the result follows. 



Now we are able to prove that the (Weak-Cut) is admissible in TC, as stated by 
Theorem 5.2: 

Theorem 5.2. Given a set of formulas F and a propositional formula A, if there 
is a closed tableau for each of the following sets of formulas. ■ 

(1) T,^LA 

(2) T^^"^ ,T"\ LA,D^LA 

(3) T,n^LA 
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then there is also a closed tableau for T, i.e. the (Weak-Cut) rule is admissible. 

Proof. Wc prove that for all sets of formulas T, if there is a closed tableau without 
(Weak-Cut) for each of the following sets of formulas: 

(1) T,^LA 

(2) T^~^ ,T^\ LA.n^LA 

(3) T,D^LA 

then there is also a closed tableau without (Weak-Cut) for F. By this property, 
given a closed tableau for a starting set of formulas Fq, a closed tableau without 
(Weak-Cut) for Fq can be obtained by eliminating all applications of (Weak-Cut), 
starting from the leafs towards the root of the tableau. 

First of all, notice that in general there can be several closed tableaux for Fq. We 
only consider closed tableaux for Fq that are minimal (in the number of nodes). 
Moreover, by Lemma A. 18 we can restrict our concern to applications of (Weak-Cut) 
whose conclusions are not obtained by applications of (h")- 

Let hl,h2,h3 be the heights of the tableaux for (1), (2), and (3) respectively. We 
proceed by induction on hi + h2 + hi. The reader might be surprised by the fact 
that the proof is carried on by single induction on the heights of the premises of 
(Weak-Cut). Indeed, the proof relies on the proof of admissibility of ordinary cut at 
the propositional level (Lemma A. 19), that is proved as usual by double induction 
on the complexity of the cut formula and on the heights of the derivation of the 
two conclusions. 

For the base case, notice that always h2 > 0, since axioms are restricted to atomic 
formulas, and F^^ , F'-' by definition does not contain any atomic formula. Our 
base case will hence be the case in which hi ~ or hi = 0, i.e. (1) or (3) are 
axioms, and h2 is minimal. 

Base Case: hi = 0, /i3 = 0, and h2 is minimal. If hi = 0, then (1) is an axiom. 
In this case, since axioms restricted to atomic formulas, it must be that P, -^P G F 
with P G ATM . Therefore we can conclude that there is a closed tableau for F 
without (Weak-Cut). 

For the inductive step, we distinguish the two following cases: 

(1) one of the conclusions of (Weak-Cut) is obtained by an application of a rule for 
the boolean connectives; 

(2) all the conclusions of (Weak-Cut) are obtained by (|~"*") or by (I/~). 

The list is exhaustive; indeed, by Lemma A. 18, we can consider, without loss of 
generality, a closed tableau in which all the conclusions of each application of (Weak- 
Cut) are obtained by a rule different from (h~). 
We consider the two cases above: 

(1) rules for the boolean connectives: first, notice that a boolean rule cannot be 
applied to the inner conclusion of (Weak-Cut), since it only contains condi- 
tional formulas (even negated), L- formulas (even negated), and a positive box 
formula. In these cases, we conclude by permuting the (Weak-Cut) rule over 
the boolean rule, i.e. we first cut the conclusion(s) of the boolean rule with the 
other conclusions of (Weak-Cut), then we conclude by applying the boolean 
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rule on the sets of formulas obtained. As an example, consider the following 
closed tableau, where the rightmost conclusion of (Weak-Cut) is obtained by 

an application of (V"*"), and where F and G arc conditional formulas: 

r'.FvG 

■ (Weak-Cut) 

(i)r',FvG,-.LA (2)r'i~±,r'° ,LA,n^LA {3)r',F\/ cu^la 

; ; ("'^^ 

{3a)r',F, D^LA {3b)r',G, n^LA 

bmce (V+) is height -preserving and cut-preserving invertible (see Theorem 
A. 17), there is a closed tableau of no greater height than (1), having no ap- 
plications of (Weak-Cut) (since the closed tableau starting with (1) does not 
contain any application of it), of (l')r',i^, -^LA and {1")T' ,G,^LA. By the 
height-preserving admissibility of weakening (see Lemma A. 16), we have also a 
closed tableau, of no greater height than (2), for {2')r'\^^ ,r'°\ F, LA,a^LA 
and for (2")r'l~±, r'°\ G, LA, D^LA. We can apply the inductive hypothe- 
sis to (1'), (2'), and (3a) to obtain a closed tableau, without applications of 
(Weak-Cut), of {*)r',F. Notice that we can apply the inductive hypothesis 
since the tableaux for (1') and (2') do not contain applications of (Weak-Cut) 
and have no greater height than (1) and (2), respectively; however, the closed 
tableau for (3a), not containing any application of (Weak-Cut), has obviously 
a smaller height than the one for (3). In the same way, we can apply the induc- 
tive hypothesis to (1"), (2"), and (36) to obtain a closed tableau for (**)r', G. 
We can conclude by applying (V"*") to (*) and (**) to obtain a proof without 
(Weak-Cut) for F', F V G. 

(2) (h^) or {L^): let us denote with a triple < i?i,i?2,-R3 > the rules apphed, 
respectively, to the three conclusions (1), (2), and (3) of (Weak-Cut), where 
Ri e {(i"), (h+), (ANY)}. We use (ANY) to represent either (L") and (h+)- 
As an example, < (i~), (l~^), (ANY) > is used to represent the case in which 
the leftmost conclusion of (Weak-Cut) (1) is obtained by an apphcation of 
(L~), whereas the inner conclusion (2) is obtained by an application of (h^); 
the rightmost conclusion (3) can be either obtained by an application of {L~) 
or by an application of (h"*"). 

We distinguish the following cases: (f) < (ANY) (ANY) (L") >, (ff) < 
(ANY),(i-),(h+) >, and (ftt) < (ANY), (h+), (h+) >. The list is ex- 
haustive. 

— (t) < (ANY) (ANY) (L") >: the tableau for (3) is started with an application 
of (L~) to a formula -^LB G T (T = F', -^LB): 

(3)T'^LB,D^LA 

We can conclude since F ^\ ^B can be obtained by applying {L^) to F = 
T' .-iLB (the formula O^LA is removed from the conclusion in an application 
of {L~)). In case the tableau for (3) is started with an application of {L~) 
on a formula LB G F, and there is no ^LBi G F, we can obviously conclude 
in the same manner; 
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— (tt) < (ANY), {L~), {\^~^) >: the proof of (3) is started with an apphcation 
of (|~^) on a formula C \~ D £ T; we have that the following sets of formulas 
have three closed tableaux without (Weak-Cut): 
—(3a) r, D^LA, -nLC 
—(3b) r^* , , -nLA, D^LC, LC 
—(3c) r, D^LA, D^LC, LC, LD 

Moreover, since the first rule applied to (2) is {L~), we have that {LA,T^^} 
has a closed tableau without (Weak-Cut). 

We want to show that also the three following sets of formulas: 

-(I) r, -.LC 

—(II) r^-* , , a^LC, lc 

—(III) r,a^LC,LC,LD 

have a closed tableau without (Weak-Cut), from which we conclude by an 
application of (h^). Wc thus want to show that: 

(I). By (3a) wc know that F, -^LC, O^LA has a closed tableau without (Weak- 
Cut); by weakening from (1) we also know that r,^LC,^LA has a closed 
tableau without (Weak-Cut); last, by (2) wc know that rl~* , D^LA, LA 
has a closed tableau without (Weak-Cut). Since the sum of the heights of 
(1), (2) and (3a) is smaller than hi 4- h2 + h3 (because the height of (3a) is 
smaller than h3), we can apply the inductive hypothesis and conclude that 

(I) r, ^LC has a closed tableau without (Weak-Cut). 

(II) Since {LA, } has a closed tableau without (Weak-Cut), by weakening, 
also rl~ , r'-' , LA, D-iLC, LC has a closed tableau without (Weak-Cut), and 
from (3b) and Lemma A.20, also (II) rl"^* , , D^LC, LC has. 

(III) . By weakening from (1), wc know that T, LC,D^LC, LD, -^LA has a 
closed tableau without (Weak-Cut); by (3c) we know that T, LC, D^LC, LD, □ 
has a closed tableau without (Weak-Cut), and by weakening from (2) we 
know that F''^ , F^^ , -iLC, D^LA, LA has a closed tableau without (Weak- 
Cut). Furthermore, the sum of the heights of the tableaux for (1), (2) and 
(3c) is smaller than hl+h2+h3. Wc can then apply the inductive hypoth- 
esis to conclude that (III): r,D^LC, LC, LD has a closed tableau without 
(Weak-Cut). 

— (ttt) < (ANY), (|~+), {\~^) >'■ as in the previous case, the proof of (3) is 
started with an application of (|~"*~) on a formula C |~ Z? £ F; we have that 
the following sets of formulas have three closed tableaux without (Weak-Cut): 
—(3a) r,D^LA,^LC 
—(3b) fI~* , F°^ , -nLA, D^LC, LC 
—(3c) F, D^LA, D^LC, LC, LD 

Moreover, we have that the first rule applied in (2) is (h^) applied to some 
conditional Ci |~ Di G F'"^ . We show that there is a conditional C; |~ Di G F 
such that: 
—ii) T, -.LC, 

—{ii) Fl~*,r°\ □^LCi,LCi 
—(iii) T, D^LCi,LCi,LDi 
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have a closed tableau without (Weak-Cut), hence also F has, since (i), {ii), 
and (in) can be obtained from F by applying (h''') to C; |~ Di. 
The tableau for (2) can contain a sequence s of applications of (h^). By 
considering only the leftmost branch introduced by the applications of (|~''' 
) in s, consider the last application of (h^) to a conditional Q |~ D^. 
We will have that (2a) fI~* , F°^ , LA, D^LA, ^LCi, . . . , -iC, has a closed 
tableau; (2b) T^r-^ ,^LA,a^LQ, LQ has a closed tableau; (2c) fI'"*,F°\ 
LA, D^LA, -iLCi, . . . , -iiCi_i, O^LCi, LCi, LDi has a closed tableau. The 
situation can be represented as follows: 



r 

T j (Weak-Cut) 

(i)r, -.LA (2)ri~ ,r° ,LA,a^LA (3)r, d^la 

; 

{2a)rl~* , r°"' , LA, n^LA, ^LCi, ^LC, . . . (2b) . . . (2c) . . . 



Furthermore, since by hypothesis the tableau for (2) does not contain any 
application of (Weak-Cut), also the tableaux for (2a), (2b), and (2c) do not 
contain any application of (Weak-Cut). 

Observe that (2a) fI^"^ , F°^ , LA, D^LA, -^LCi, -^LQ cannot be an in- 
stance of (AX) , since axioms are restricted to atomic formulas only, and (2a) 
only contains conditionals, L-formulas, and boxed formulas. Therefore, we 
can observe that the rule applied to (2a) is {L~): indeed, if the rule was (h~) 
applied to some -(Cfc \~Cj) e fI~±, then we could find a shorter derivation, 
obtained by applying (|~~) to (2)fI'^ ,r^\ LA, O^LA, against the mini- 
mality of the closed tableau we are considering. This situation would be as 
follows: 



r 

T j (Weak-Cut) 

(l)r,^LA (2)rl~ ,r° ,LA,O^LA (3)r, D^LA 

' 

ri~ ,r° ,LA,a^LA,^LCi ... 

rl~* , r°\ LA, □-.LA, ^LCi , . . . , -.LCi . . . 

(I~") 

(rl~± - {^(Cfe |~ Cj)}), LCk, D-LCfe, -LCj 



(Weak-Cut) 



(l)r, -.LA (2)rl~*,r°\ LA, D^LA (3)r, □-.LA 

(ri~± - {^(Cfe h Cj)}), LCk, n^LCk,^LCj . . . 
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More precisely, we can observe that the rule applied to (2a) is {L~) applied to 
-iLCi'. indeed, if {L~) was applied to a previously generated negated formula, 
there would be a shorter tableau obtained by immediately applying (L^) to 
that formula, as represented by the following derivations: 



ri~ ,r°\LA,n-.LA,^i,Ci,...,-.LCh, 



ri~* , r°"^ , LA, n^LA, -.lci, . . . , ^lch 



(L-) 



Hence, A,^Ci has a closed tableau without (Weak-Cut), and hence also 
{*)LA,^LCi has a closed tableau without (Weak-Cut). From (*) and (1), 
with opportune weakenings, by Lemma A. 20 we derive that (i) : F, -iLd 
has a closed tableau without (Weak-Cut). By weakening from (26), we have 
that F^"* , F°'^ , -.L^, D-iLCi, Ld has a closed tableau without (Weak-Cut). 
From this set of formulas, (2), weakening, and Lemma A. 20, wc also know 
that: fI~*,F°', U^LA,U^LCi,LCi has a closed tableau without (Weak- 
Cut). From this set of formulas, (*) and Lemma A. 21, we conclude that also 
(ii)Fl'^*,F°\n^LQ,LCi has a closed tableau without (Weak-Cut). 
Consider now {iii): wc can show that T,O^LCi, LCi, LDi has a closed 
tableau without (Weak-Cut). Indeed, wc can repeat the same proofs of case 
(tt) in order to show that (I) T^LC and (III) F, D^LC, LC, LD have a closed 
tableau without (Weak-Cut) (in (jf) there was no assumption on the first rule 
applied to (2) to show that (I) and (III) have a closed tableau). In order to 
show that (iii) has a closed tableau without (Weak-Cut), we observe that: by 
weakening from (I), (F)F, O^LCi, LCi, LDi, -^LC has a closed tableau with- 
out (Weak-Cut); by weakening from (III), {llV)T,n^LQ, Ld, LDi.O^LC, 
LC,LD has a closed tableau without (Weak-Cut); since (3b) and (*) have 
closed tableaux without (Weak-Cut), by Lemma A. 20 we have that (IF)fI'^ , F' 
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-^LCi,D^LC, LC has a closed tableau without (Weak-Cut). We conclude 
that {in)r, LCi,D^LCi, LDi has a closed tableau without (Weak-Cut), ob- 
tained by applying (h+) to (F), (H'), and (III'). 

We have hence proven that (i), (ii), and (Hi) have a closed tableau without 
(Weak-Cut), then we can conclude by applying (h+) to them to obtain a 
closed tableau for T. 



Proof of Theorem 6.4. Given any rule (R) o/TR"^, whose premise is T and whose 
conclusions are Ti, with i = 1,2,3, we have that ifT has a closed tableau of height 
h, then there is a closed tableau, of height no greater than h, for each Ti, i.e. the 
rules of TR'^ are height-preserving invertible. 

We consider each rule of the calculus, then we proceed by induction on the height 
of the closed tableau for the premise. 

— (h^): given a closed tableau for T,u : A \~ B, then we can immediately conclude 
that there is also a closed tableau for T,u : A \^ B,x : -^A, for r,u : A |~ 
B, X : -iD-iA, and for T,u : A \^ B,x : B, since weakening is height-preserving 
admissible (see Lemma 6.3); 

— (<): as in the previous case, a closed tableau for the two conclusions of the rule 
can be obtained by weakening from the premise; 

— (□"): given a closed tableau for (l)r, x : -^D^A and a label y not occurring in F, 
we have to show that there is a closed tableau for r,y < x, F^if^y, y : A,y : O^A. 
By induction on the height of the proof of (1), we distinguish the following cases: 
— the first rule applied is (□") on x : -^D^A: in this case, we are done, since we 

have a closed tableau for T,y < x, T^i^y, y : A,y : O^A; 
— otherwise, i.e. another rule (R) of TTC^ is applied to F, x : -iQ-iA, we can apply 
the inductive hypothesis on the conclusion(s) of (R), since no rule removes side 
formulas in a rule application. In detail, we have that x : -iQ-iA belongs to all 
the conclusions, then we can apply the inductive hypothesis and then conclude 
by re-applying (R). As an example, suppose the derivation starts with an 
application of (|~~) as follows: 

(l)F',it : C H D,a; : -^D^A 

(2)F', v:C,v: D^C, v:^D,x: ^D^A 

We can apply the inductive hypothesis on the closed tableau for (2), concluding 
that there is a closed tableau for (2')F', v:C,v: □-■C, i; : -.1?, y < x, T^'_^y,y : 
A, y : Q-iA, from which we can conclude obtaining the following closed tableau: 

T',u:C\^D,y<x,T^ly,y:A,y:D^A 
(2')F', v:C,v: D-C, v: ^D,y < x, F^^^, y : A,y : D^A ^ 

Notice that the proof has (at most) the same height of the closed tableau for (1). 
— other rules: the proof is similar to the one for (D^) and then left to the reader. 
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Proof of Lemma 6.7. Given a tableau starting with xq : F , for any open, saturated 
branch B = Fi, . . . , r„, . . we have that: 

(1) if z < y £ Ti in 'B and y < x £ Tj m B, then there exists Tk in B such that 

z < X eVk; 

(2) if X : D^A G F; in B and y < x eTj in B, then there exists Ffe in B such that 
y : eTk and y : D^A e Ffc; 

(3) for no Ti in'B, x < x € F^. 

Let us consider an open, saturated branch B = Fi, F2, . . . , F„, . . .. We consider 
separately the three claims in the definition of the Lemma: 

(1) We are considering the case when z < y E Ti in B and y < x G F^ in B. 
Since B is saturated, then there exists F/^ in B such that either z < x (z 

OT X < y € Tk- If X < y S Ffc, then the branch is closed (Ffc is an instance of 
(AX)). Thus, we conclude that z < 2: G Ffc. 

(2) A relation formula y < x can only be introduced by an application of either 
(□~) or (<); in both cases, T^i_^y is added to the current branch of the tableau. 
Consider any x : O-iA G F,;; if j > i, i.e. y < x is introduced in the branch 
after x : O^A, then we are done, since y : ^A G F*^^^^ and y : D^A G T^i^y. 
Otherwise, if y < x is introduced in the branch before x : D-iA, then we are 
considering the case such that x : D^A is introduced by an application of (<), 
i.e. X : D^A G F^^ (by the presence of some k : D^A in the branch) for some 
k and x < A: is also introduced in the branch. Since the branch is saturated, 
then either (1) x < y or (2) y < k are introduced in the branch: (1) cannot 
be, otherwise the branch would be closed. If (2) is introduced after k : D^A, 
then we are done since y : -^A G T^_^y and y : D^A G F*;!;^^; otherwise, (2) 
has also been introduced by an application of (<), and we can reason in the 
same way described here above. This process terminates: indeed, we can easily 
observe the following facts: - a boxed formula u : D^A is initially introduced 
in the tableau by an application of either (D^) or (h^), whereas (<) and (D^) 
only "propagate" it to other worlds; - in both cases {0~) and (h~), u is a new 
label not occurring in the branch, therefore all the relation formulas v < u will 
be introduced later in the branch, i.e. when u : D^A already belongs to the 
branch. In conclusion of our proof, a relation formula y < u will be introduced 
in the branch not before of u : Q-iyl: by this fact and by the saturation of the 
branch, we conclude that also y < u and, then, y : ^A and y : D-iyl belong to 
the branch. 

(3) A relation x < x cannot be introduced by rule (D^), since this rule establishes 
a relation between x in B and a label distinct from x. On the other hand, 
it cannot be introduced by modularity. Indeed, for rule (<) to introduce a 
relation x < x, there must be in B some relation y < x (resp. x < y) for some 
y. But in this case the side condition of the rule would not be fulfilled, and the 
rule could not be applied. 
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